1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  25  */
  26 
  27 /* This file contains all TCP input processing functions. */
  28 
  29 #include <sys/types.h>
  30 #include <sys/stream.h>
  31 #include <sys/strsun.h>
  32 #include <sys/strsubr.h>
  33 #include <sys/stropts.h>
  34 #include <sys/strlog.h>
  35 #define _SUN_TPI_VERSION 2
  36 #include <sys/tihdr.h>
  37 #include <sys/suntpi.h>
  38 #include <sys/xti_inet.h>
  39 #include <sys/squeue_impl.h>
  40 #include <sys/squeue.h>
  41 #include <sys/tsol/tnet.h>
  42 
  43 #include <inet/common.h>
  44 #include <inet/ip.h>
  45 #include <inet/tcp.h>
  46 #include <inet/tcp_impl.h>
  47 #include <inet/tcp_cluster.h>
  48 #include <inet/proto_set.h>
  49 #include <inet/ipsec_impl.h>
  50 
  51 /*
  52  * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
  53  */
  54 
  55 #ifdef _BIG_ENDIAN
  56 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
  57         (TCPOPT_TSTAMP << 8) | 10)
  58 #else
  59 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
  60         (TCPOPT_NOP << 8) | TCPOPT_NOP)
  61 #endif
  62 
  63 /*
  64  * Flags returned from tcp_parse_options.
  65  */
  66 #define TCP_OPT_MSS_PRESENT     1
  67 #define TCP_OPT_WSCALE_PRESENT  2
  68 #define TCP_OPT_TSTAMP_PRESENT  4
  69 #define TCP_OPT_SACK_OK_PRESENT 8
  70 #define TCP_OPT_SACK_PRESENT    16
  71 
  72 /*
  73  *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days
  74  */
  75 #define PAWS_TIMEOUT    ((clock_t)(24*24*60*60*hz))
  76 
  77 /*
  78  * Since tcp_listener is not cleared atomically with tcp_detached
  79  * being cleared we need this extra bit to tell a detached connection
  80  * apart from one that is in the process of being accepted.
  81  */
  82 #define TCP_IS_DETACHED_NONEAGER(tcp)   \
  83         (TCP_IS_DETACHED(tcp) &&        \
  84             (!(tcp)->tcp_hard_binding))
  85 
  86 /*
  87  * Steps to do when a tcp_t moves to TIME-WAIT state.
  88  *
  89  * This connection is done, we don't need to account for it.  Decrement
  90  * the listener connection counter if needed.
  91  *
  92  * Decrement the connection counter of the stack.  Note that this counter
  93  * is per CPU.  So the total number of connections in a stack is the sum of all
  94  * of them.  Since there is no lock for handling all of them exclusively, the
  95  * resulting sum is only an approximation.
  96  *
  97  * Unconditionally clear the exclusive binding bit so this TIME-WAIT
  98  * connection won't interfere with new ones.
  99  *
 100  * Start the TIME-WAIT timer.  If upper layer has not closed the connection,
 101  * the timer is handled within the context of this tcp_t.  When the timer
 102  * fires, tcp_clean_death() is called.  If upper layer closes the connection
 103  * during this period, tcp_time_wait_append() will be called to add this
 104  * tcp_t to the global TIME-WAIT list.  Note that this means that the
 105  * actual wait time in TIME-WAIT state will be longer than the
 106  * tcps_time_wait_interval since the period before upper layer closes the
 107  * connection is not accounted for when tcp_time_wait_append() is called.
 108  *
 109  * If uppser layer has closed the connection, call tcp_time_wait_append()
 110  * directly.
 111  *
 112  */
 113 #define SET_TIME_WAIT(tcps, tcp, connp)                         \
 114 {                                                               \
 115         (tcp)->tcp_state = TCPS_TIME_WAIT;                   \
 116         if ((tcp)->tcp_listen_cnt != NULL)                   \
 117                 TCP_DECR_LISTEN_CNT(tcp);                       \
 118         atomic_dec_64(                                          \
 119             (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
 120         (connp)->conn_exclbind = 0;                          \
 121         if (!TCP_IS_DETACHED(tcp)) {                            \
 122                 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
 123         } else {                                                \
 124                 tcp_time_wait_append(tcp);                      \
 125                 TCP_DBGSTAT(tcps, tcp_rput_time_wait);          \
 126         }                                                       \
 127 }
 128 
 129 /*
 130  * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
 131  * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
 132  * data, TCP will not respond with an ACK.  RFC 793 requires that
 133  * TCP responds with an ACK for such a bogus ACK.  By not following
 134  * the RFC, we prevent TCP from getting into an ACK storm if somehow
 135  * an attacker successfully spoofs an acceptable segment to our
 136  * peer; or when our peer is "confused."
 137  */
 138 static uint32_t tcp_drop_ack_unsent_cnt = 10;
 139 
 140 /*
 141  * To protect TCP against attacker using a small window and requesting
 142  * large amount of data (DoS attack by conuming memory), TCP checks the
 143  * window advertised in the last ACK of the 3-way handshake.  TCP uses
 144  * the tcp_mss (the size of one packet) value for comparion.  The window
 145  * should be larger than tcp_mss.  But while a sane TCP should advertise
 146  * a receive window larger than or equal to 4*MSS to avoid stop and go
 147  * tarrfic, not all TCP stacks do that.  This is especially true when
 148  * tcp_mss is a big value.
 149  *
 150  * To work around this issue, an additional fixed value for comparison
 151  * is also used.  If the advertised window is smaller than both tcp_mss
 152  * and tcp_init_wnd_chk, the ACK is considered as invalid.  So for large
 153  * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
 154  * smaller than 8K is considered to be OK.
 155  */
 156 static uint32_t tcp_init_wnd_chk = 4096;
 157 
 158 /* Process ICMP source quench message or not. */
 159 static boolean_t tcp_icmp_source_quench = B_FALSE;
 160 
 161 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
 162 
 163 static mblk_t   *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
 164                     ip_recv_attr_t *);
 165 static mblk_t   *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
 166                     ip_recv_attr_t *);
 167 static boolean_t        tcp_drop_q0(tcp_t *);
 168 static void     tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
 169 static mblk_t   *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
 170                     ip_recv_attr_t *);
 171 static void     tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
 172 static int      tcp_parse_options(tcpha_t *, tcp_opt_t *);
 173 static void     tcp_process_options(tcp_t *, tcpha_t *);
 174 static mblk_t   *tcp_reass(tcp_t *, mblk_t *, uint32_t);
 175 static void     tcp_reass_elim_overlap(tcp_t *, mblk_t *);
 176 static void     tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 177 static void     tcp_set_rto(tcp_t *, time_t);
 178 static void     tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
 179 
 180 /*
 181  * Set the MSS associated with a particular tcp based on its current value,
 182  * and a new one passed in. Observe minimums and maximums, and reset other
 183  * state variables that we want to view as multiples of MSS.
 184  *
 185  * The value of MSS could be either increased or descreased.
 186  */
 187 void
 188 tcp_mss_set(tcp_t *tcp, uint32_t mss)
 189 {
 190         uint32_t        mss_max;
 191         tcp_stack_t     *tcps = tcp->tcp_tcps;
 192         conn_t          *connp = tcp->tcp_connp;
 193 
 194         if (connp->conn_ipversion == IPV4_VERSION)
 195                 mss_max = tcps->tcps_mss_max_ipv4;
 196         else
 197                 mss_max = tcps->tcps_mss_max_ipv6;
 198 
 199         if (mss < tcps->tcps_mss_min)
 200                 mss = tcps->tcps_mss_min;
 201         if (mss > mss_max)
 202                 mss = mss_max;
 203         /*
 204          * Unless naglim has been set by our client to
 205          * a non-mss value, force naglim to track mss.
 206          * This can help to aggregate small writes.
 207          */
 208         if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
 209                 tcp->tcp_naglim = mss;
 210         /*
 211          * TCP should be able to buffer at least 4 MSS data for obvious
 212          * performance reason.
 213          */
 214         if ((mss << 2) > connp->conn_sndbuf)
 215                 connp->conn_sndbuf = mss << 2;
 216 
 217         /*
 218          * Set the send lowater to at least twice of MSS.
 219          */
 220         if ((mss << 1) > connp->conn_sndlowat)
 221                 connp->conn_sndlowat = mss << 1;
 222 
 223         /*
 224          * Update tcp_cwnd according to the new value of MSS. Keep the
 225          * previous ratio to preserve the transmit rate.
 226          */
 227         tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
 228         tcp->tcp_cwnd_cnt = 0;
 229 
 230         tcp->tcp_mss = mss;
 231         (void) tcp_maxpsz_set(tcp, B_TRUE);
 232 }
 233 
 234 /*
 235  * Extract option values from a tcp header.  We put any found values into the
 236  * tcpopt struct and return a bitmask saying which options were found.
 237  */
 238 static int
 239 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
 240 {
 241         uchar_t         *endp;
 242         int             len;
 243         uint32_t        mss;
 244         uchar_t         *up = (uchar_t *)tcpha;
 245         int             found = 0;
 246         int32_t         sack_len;
 247         tcp_seq         sack_begin, sack_end;
 248         tcp_t           *tcp;
 249 
 250         endp = up + TCP_HDR_LENGTH(tcpha);
 251         up += TCP_MIN_HEADER_LENGTH;
 252         while (up < endp) {
 253                 len = endp - up;
 254                 switch (*up) {
 255                 case TCPOPT_EOL:
 256                         break;
 257 
 258                 case TCPOPT_NOP:
 259                         up++;
 260                         continue;
 261 
 262                 case TCPOPT_MAXSEG:
 263                         if (len < TCPOPT_MAXSEG_LEN ||
 264                             up[1] != TCPOPT_MAXSEG_LEN)
 265                                 break;
 266 
 267                         mss = BE16_TO_U16(up+2);
 268                         /* Caller must handle tcp_mss_min and tcp_mss_max_* */
 269                         tcpopt->tcp_opt_mss = mss;
 270                         found |= TCP_OPT_MSS_PRESENT;
 271 
 272                         up += TCPOPT_MAXSEG_LEN;
 273                         continue;
 274 
 275                 case TCPOPT_WSCALE:
 276                         if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
 277                                 break;
 278 
 279                         if (up[2] > TCP_MAX_WINSHIFT)
 280                                 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
 281                         else
 282                                 tcpopt->tcp_opt_wscale = up[2];
 283                         found |= TCP_OPT_WSCALE_PRESENT;
 284 
 285                         up += TCPOPT_WS_LEN;
 286                         continue;
 287 
 288                 case TCPOPT_SACK_PERMITTED:
 289                         if (len < TCPOPT_SACK_OK_LEN ||
 290                             up[1] != TCPOPT_SACK_OK_LEN)
 291                                 break;
 292                         found |= TCP_OPT_SACK_OK_PRESENT;
 293                         up += TCPOPT_SACK_OK_LEN;
 294                         continue;
 295 
 296                 case TCPOPT_SACK:
 297                         if (len <= 2 || up[1] <= 2 || len < up[1])
 298                                 break;
 299 
 300                         /* If TCP is not interested in SACK blks... */
 301                         if ((tcp = tcpopt->tcp) == NULL) {
 302                                 up += up[1];
 303                                 continue;
 304                         }
 305                         sack_len = up[1] - TCPOPT_HEADER_LEN;
 306                         up += TCPOPT_HEADER_LEN;
 307 
 308                         /*
 309                          * If the list is empty, allocate one and assume
 310                          * nothing is sack'ed.
 311                          */
 312                         if (tcp->tcp_notsack_list == NULL) {
 313                                 tcp_notsack_update(&(tcp->tcp_notsack_list),
 314                                     tcp->tcp_suna, tcp->tcp_snxt,
 315                                     &(tcp->tcp_num_notsack_blk),
 316                                     &(tcp->tcp_cnt_notsack_list));
 317 
 318                                 /*
 319                                  * Make sure tcp_notsack_list is not NULL.
 320                                  * This happens when kmem_alloc(KM_NOSLEEP)
 321                                  * returns NULL.
 322                                  */
 323                                 if (tcp->tcp_notsack_list == NULL) {
 324                                         up += sack_len;
 325                                         continue;
 326                                 }
 327                                 tcp->tcp_fack = tcp->tcp_suna;
 328                         }
 329 
 330                         while (sack_len > 0) {
 331                                 if (up + 8 > endp) {
 332                                         up = endp;
 333                                         break;
 334                                 }
 335                                 sack_begin = BE32_TO_U32(up);
 336                                 up += 4;
 337                                 sack_end = BE32_TO_U32(up);
 338                                 up += 4;
 339                                 sack_len -= 8;
 340                                 /*
 341                                  * Bounds checking.  Make sure the SACK
 342                                  * info is within tcp_suna and tcp_snxt.
 343                                  * If this SACK blk is out of bound, ignore
 344                                  * it but continue to parse the following
 345                                  * blks.
 346                                  */
 347                                 if (SEQ_LEQ(sack_end, sack_begin) ||
 348                                     SEQ_LT(sack_begin, tcp->tcp_suna) ||
 349                                     SEQ_GT(sack_end, tcp->tcp_snxt)) {
 350                                         continue;
 351                                 }
 352                                 tcp_notsack_insert(&(tcp->tcp_notsack_list),
 353                                     sack_begin, sack_end,
 354                                     &(tcp->tcp_num_notsack_blk),
 355                                     &(tcp->tcp_cnt_notsack_list));
 356                                 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
 357                                         tcp->tcp_fack = sack_end;
 358                                 }
 359                         }
 360                         found |= TCP_OPT_SACK_PRESENT;
 361                         continue;
 362 
 363                 case TCPOPT_TSTAMP:
 364                         if (len < TCPOPT_TSTAMP_LEN ||
 365                             up[1] != TCPOPT_TSTAMP_LEN)
 366                                 break;
 367 
 368                         tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
 369                         tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
 370 
 371                         found |= TCP_OPT_TSTAMP_PRESENT;
 372 
 373                         up += TCPOPT_TSTAMP_LEN;
 374                         continue;
 375 
 376                 default:
 377                         if (len <= 1 || len < (int)up[1] || up[1] == 0)
 378                                 break;
 379                         up += up[1];
 380                         continue;
 381                 }
 382                 break;
 383         }
 384         return (found);
 385 }
 386 
 387 /*
 388  * Process all TCP option in SYN segment.  Note that this function should
 389  * be called after tcp_set_destination() is called so that the necessary info
 390  * from IRE is already set in the tcp structure.
 391  *
 392  * This function sets up the correct tcp_mss value according to the
 393  * MSS option value and our header size.  It also sets up the window scale
 394  * and timestamp values, and initialize SACK info blocks.  But it does not
 395  * change receive window size after setting the tcp_mss value.  The caller
 396  * should do the appropriate change.
 397  */
 398 static void
 399 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
 400 {
 401         int options;
 402         tcp_opt_t tcpopt;
 403         uint32_t mss_max;
 404         char *tmp_tcph;
 405         tcp_stack_t     *tcps = tcp->tcp_tcps;
 406         conn_t          *connp = tcp->tcp_connp;
 407 
 408         tcpopt.tcp = NULL;
 409         options = tcp_parse_options(tcpha, &tcpopt);
 410 
 411         /*
 412          * Process MSS option.  Note that MSS option value does not account
 413          * for IP or TCP options.  This means that it is equal to MTU - minimum
 414          * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
 415          * IPv6.
 416          */
 417         if (!(options & TCP_OPT_MSS_PRESENT)) {
 418                 if (connp->conn_ipversion == IPV4_VERSION)
 419                         tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
 420                 else
 421                         tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
 422         } else {
 423                 if (connp->conn_ipversion == IPV4_VERSION)
 424                         mss_max = tcps->tcps_mss_max_ipv4;
 425                 else
 426                         mss_max = tcps->tcps_mss_max_ipv6;
 427                 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
 428                         tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
 429                 else if (tcpopt.tcp_opt_mss > mss_max)
 430                         tcpopt.tcp_opt_mss = mss_max;
 431         }
 432 
 433         /* Process Window Scale option. */
 434         if (options & TCP_OPT_WSCALE_PRESENT) {
 435                 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
 436                 tcp->tcp_snd_ws_ok = B_TRUE;
 437         } else {
 438                 tcp->tcp_snd_ws = B_FALSE;
 439                 tcp->tcp_snd_ws_ok = B_FALSE;
 440                 tcp->tcp_rcv_ws = B_FALSE;
 441         }
 442 
 443         /* Process Timestamp option. */
 444         if ((options & TCP_OPT_TSTAMP_PRESENT) &&
 445             (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
 446                 tmp_tcph = (char *)tcp->tcp_tcpha;
 447 
 448                 tcp->tcp_snd_ts_ok = B_TRUE;
 449                 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
 450                 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
 451                 ASSERT(OK_32PTR(tmp_tcph));
 452                 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
 453 
 454                 /* Fill in our template header with basic timestamp option. */
 455                 tmp_tcph += connp->conn_ht_ulp_len;
 456                 tmp_tcph[0] = TCPOPT_NOP;
 457                 tmp_tcph[1] = TCPOPT_NOP;
 458                 tmp_tcph[2] = TCPOPT_TSTAMP;
 459                 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
 460                 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
 461                 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
 462                 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
 463         } else {
 464                 tcp->tcp_snd_ts_ok = B_FALSE;
 465         }
 466 
 467         /*
 468          * Process SACK options.  If SACK is enabled for this connection,
 469          * then allocate the SACK info structure.  Note the following ways
 470          * when tcp_snd_sack_ok is set to true.
 471          *
 472          * For active connection: in tcp_set_destination() called in
 473          * tcp_connect().
 474          *
 475          * For passive connection: in tcp_set_destination() called in
 476          * tcp_input_listener().
 477          *
 478          * That's the reason why the extra TCP_IS_DETACHED() check is there.
 479          * That check makes sure that if we did not send a SACK OK option,
 480          * we will not enable SACK for this connection even though the other
 481          * side sends us SACK OK option.  For active connection, the SACK
 482          * info structure has already been allocated.  So we need to free
 483          * it if SACK is disabled.
 484          */
 485         if ((options & TCP_OPT_SACK_OK_PRESENT) &&
 486             (tcp->tcp_snd_sack_ok ||
 487             (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
 488                 ASSERT(tcp->tcp_num_sack_blk == 0);
 489                 ASSERT(tcp->tcp_notsack_list == NULL);
 490 
 491                 tcp->tcp_snd_sack_ok = B_TRUE;
 492                 if (tcp->tcp_snd_ts_ok) {
 493                         tcp->tcp_max_sack_blk = 3;
 494                 } else {
 495                         tcp->tcp_max_sack_blk = 4;
 496                 }
 497         } else if (tcp->tcp_snd_sack_ok) {
 498                 /*
 499                  * Resetting tcp_snd_sack_ok to B_FALSE so that
 500                  * no SACK info will be used for this
 501                  * connection.  This assumes that SACK usage
 502                  * permission is negotiated.  This may need
 503                  * to be changed once this is clarified.
 504                  */
 505                 ASSERT(tcp->tcp_num_sack_blk == 0);
 506                 ASSERT(tcp->tcp_notsack_list == NULL);
 507                 tcp->tcp_snd_sack_ok = B_FALSE;
 508         }
 509 
 510         /*
 511          * Now we know the exact TCP/IP header length, subtract
 512          * that from tcp_mss to get our side's MSS.
 513          */
 514         tcp->tcp_mss -= connp->conn_ht_iphc_len;
 515 
 516         /*
 517          * Here we assume that the other side's header size will be equal to
 518          * our header size.  We calculate the real MSS accordingly.  Need to
 519          * take into additional stuffs IPsec puts in.
 520          *
 521          * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
 522          */
 523         tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
 524             tcp->tcp_ipsec_overhead -
 525             ((connp->conn_ipversion == IPV4_VERSION ?
 526             IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
 527 
 528         /*
 529          * Set MSS to the smaller one of both ends of the connection.
 530          * We should not have called tcp_mss_set() before, but our
 531          * side of the MSS should have been set to a proper value
 532          * by tcp_set_destination().  tcp_mss_set() will also set up the
 533          * STREAM head parameters properly.
 534          *
 535          * If we have a larger-than-16-bit window but the other side
 536          * didn't want to do window scale, tcp_rwnd_set() will take
 537          * care of that.
 538          */
 539         tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
 540 
 541         /*
 542          * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
 543          * updated properly.
 544          */
 545         TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
 546 }
 547 
 548 /*
 549  * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
 550  * is filled, return as much as we can.  The message passed in may be
 551  * multi-part, chained using b_cont.  "start" is the starting sequence
 552  * number for this piece.
 553  */
 554 static mblk_t *
 555 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
 556 {
 557         uint32_t        end;
 558         mblk_t          *mp1;
 559         mblk_t          *mp2;
 560         mblk_t          *next_mp;
 561         uint32_t        u1;
 562         tcp_stack_t     *tcps = tcp->tcp_tcps;
 563 
 564 
 565         /* Walk through all the new pieces. */
 566         do {
 567                 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
 568                     (uintptr_t)INT_MAX);
 569                 end = start + (int)(mp->b_wptr - mp->b_rptr);
 570                 next_mp = mp->b_cont;
 571                 if (start == end) {
 572                         /* Empty.  Blast it. */
 573                         freeb(mp);
 574                         continue;
 575                 }
 576                 mp->b_cont = NULL;
 577                 TCP_REASS_SET_SEQ(mp, start);
 578                 TCP_REASS_SET_END(mp, end);
 579                 mp1 = tcp->tcp_reass_tail;
 580                 if (!mp1) {
 581                         tcp->tcp_reass_tail = mp;
 582                         tcp->tcp_reass_head = mp;
 583                         TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
 584                         TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
 585                             end - start);
 586                         continue;
 587                 }
 588                 /* New stuff completely beyond tail? */
 589                 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
 590                         /* Link it on end. */
 591                         mp1->b_cont = mp;
 592                         tcp->tcp_reass_tail = mp;
 593                         TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
 594                         TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
 595                             end - start);
 596                         continue;
 597                 }
 598                 mp1 = tcp->tcp_reass_head;
 599                 u1 = TCP_REASS_SEQ(mp1);
 600                 /* New stuff at the front? */
 601                 if (SEQ_LT(start, u1)) {
 602                         /* Yes... Check for overlap. */
 603                         mp->b_cont = mp1;
 604                         tcp->tcp_reass_head = mp;
 605                         tcp_reass_elim_overlap(tcp, mp);
 606                         continue;
 607                 }
 608                 /*
 609                  * The new piece fits somewhere between the head and tail.
 610                  * We find our slot, where mp1 precedes us and mp2 trails.
 611                  */
 612                 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
 613                         u1 = TCP_REASS_SEQ(mp2);
 614                         if (SEQ_LEQ(start, u1))
 615                                 break;
 616                 }
 617                 /* Link ourselves in */
 618                 mp->b_cont = mp2;
 619                 mp1->b_cont = mp;
 620 
 621                 /* Trim overlap with following mblk(s) first */
 622                 tcp_reass_elim_overlap(tcp, mp);
 623 
 624                 /* Trim overlap with preceding mblk */
 625                 tcp_reass_elim_overlap(tcp, mp1);
 626 
 627         } while (start = end, mp = next_mp);
 628         mp1 = tcp->tcp_reass_head;
 629         /* Anything ready to go? */
 630         if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
 631                 return (NULL);
 632         /* Eat what we can off the queue */
 633         for (;;) {
 634                 mp = mp1->b_cont;
 635                 end = TCP_REASS_END(mp1);
 636                 TCP_REASS_SET_SEQ(mp1, 0);
 637                 TCP_REASS_SET_END(mp1, 0);
 638                 if (!mp) {
 639                         tcp->tcp_reass_tail = NULL;
 640                         break;
 641                 }
 642                 if (end != TCP_REASS_SEQ(mp)) {
 643                         mp1->b_cont = NULL;
 644                         break;
 645                 }
 646                 mp1 = mp;
 647         }
 648         mp1 = tcp->tcp_reass_head;
 649         tcp->tcp_reass_head = mp;
 650         return (mp1);
 651 }
 652 
 653 /* Eliminate any overlap that mp may have over later mblks */
 654 static void
 655 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
 656 {
 657         uint32_t        end;
 658         mblk_t          *mp1;
 659         uint32_t        u1;
 660         tcp_stack_t     *tcps = tcp->tcp_tcps;
 661 
 662         end = TCP_REASS_END(mp);
 663         while ((mp1 = mp->b_cont) != NULL) {
 664                 u1 = TCP_REASS_SEQ(mp1);
 665                 if (!SEQ_GT(end, u1))
 666                         break;
 667                 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
 668                         mp->b_wptr -= end - u1;
 669                         TCP_REASS_SET_END(mp, u1);
 670                         TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
 671                         TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
 672                             end - u1);
 673                         break;
 674                 }
 675                 mp->b_cont = mp1->b_cont;
 676                 TCP_REASS_SET_SEQ(mp1, 0);
 677                 TCP_REASS_SET_END(mp1, 0);
 678                 freeb(mp1);
 679                 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
 680                 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
 681         }
 682         if (!mp1)
 683                 tcp->tcp_reass_tail = mp;
 684 }
 685 
 686 /*
 687  * This function does PAWS protection check. Returns B_TRUE if the
 688  * segment passes the PAWS test, else returns B_FALSE.
 689  */
 690 boolean_t
 691 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp)
 692 {
 693         uint8_t flags;
 694         int     options;
 695         uint8_t *up;
 696         conn_t  *connp = tcp->tcp_connp;
 697 
 698         flags = (unsigned int)tcpha->tha_flags & 0xFF;
 699         /*
 700          * If timestamp option is aligned nicely, get values inline,
 701          * otherwise call general routine to parse.  Only do that
 702          * if timestamp is the only option.
 703          */
 704         if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
 705             TCPOPT_REAL_TS_LEN &&
 706             OK_32PTR((up = ((uint8_t *)tcpha) +
 707             TCP_MIN_HEADER_LENGTH)) &&
 708             *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
 709                 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
 710                 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
 711 
 712                 options = TCP_OPT_TSTAMP_PRESENT;
 713         } else {
 714                 if (tcp->tcp_snd_sack_ok) {
 715                         tcpoptp->tcp = tcp;
 716                 } else {
 717                         tcpoptp->tcp = NULL;
 718                 }
 719                 options = tcp_parse_options(tcpha, tcpoptp);
 720         }
 721 
 722         if (options & TCP_OPT_TSTAMP_PRESENT) {
 723                 /*
 724                  * Do PAWS per RFC 1323 section 4.2.  Accept RST
 725                  * regardless of the timestamp, page 18 RFC 1323.bis.
 726                  */
 727                 if ((flags & TH_RST) == 0 &&
 728                     TSTMP_LT(tcpoptp->tcp_opt_ts_val,
 729                     tcp->tcp_ts_recent)) {
 730                         if (LBOLT_FASTPATH64 <
 731                             (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
 732                                 /* This segment is not acceptable. */
 733                                 return (B_FALSE);
 734                         } else {
 735                                 /*
 736                                  * Connection has been idle for
 737                                  * too long.  Reset the timestamp
 738                                  * and assume the segment is valid.
 739                                  */
 740                                 tcp->tcp_ts_recent =
 741                                     tcpoptp->tcp_opt_ts_val;
 742                         }
 743                 }
 744         } else {
 745                 /*
 746                  * If we don't get a timestamp on every packet, we
 747                  * figure we can't really trust 'em, so we stop sending
 748                  * and parsing them.
 749                  */
 750                 tcp->tcp_snd_ts_ok = B_FALSE;
 751 
 752                 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN;
 753                 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN;
 754                 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4);
 755                 /*
 756                  * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
 757                  * doing a slow start here so as to not to lose on the
 758                  * transfer rate built up so far.
 759                  */
 760                 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
 761                 if (tcp->tcp_snd_sack_ok)
 762                         tcp->tcp_max_sack_blk = 4;
 763         }
 764         return (B_TRUE);
 765 }
 766 
 767 /*
 768  * Defense for the SYN attack -
 769  * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
 770  *    one from the list of droppable eagers. This list is a subset of q0.
 771  *    see comments before the definition of MAKE_DROPPABLE().
 772  * 2. Don't drop a SYN request before its first timeout. This gives every
 773  *    request at least til the first timeout to complete its 3-way handshake.
 774  * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
 775  *    requests currently on the queue that has timed out. This will be used
 776  *    as an indicator of whether an attack is under way, so that appropriate
 777  *    actions can be taken. (It's incremented in tcp_timer() and decremented
 778  *    either when eager goes into ESTABLISHED, or gets freed up.)
 779  * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
 780  *    # of timeout drops back to <= q0len/32 => SYN alert off
 781  */
 782 static boolean_t
 783 tcp_drop_q0(tcp_t *tcp)
 784 {
 785         tcp_t   *eager;
 786         mblk_t  *mp;
 787         tcp_stack_t     *tcps = tcp->tcp_tcps;
 788 
 789         ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
 790         ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
 791 
 792         /* Pick oldest eager from the list of droppable eagers */
 793         eager = tcp->tcp_eager_prev_drop_q0;
 794 
 795         /* If list is empty. return B_FALSE */
 796         if (eager == tcp) {
 797                 return (B_FALSE);
 798         }
 799 
 800         /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
 801         if ((mp = allocb(0, BPRI_HI)) == NULL)
 802                 return (B_FALSE);
 803 
 804         /*
 805          * Take this eager out from the list of droppable eagers since we are
 806          * going to drop it.
 807          */
 808         MAKE_UNDROPPABLE(eager);
 809 
 810         if (tcp->tcp_connp->conn_debug) {
 811                 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
 812                     "tcp_drop_q0: listen half-open queue (max=%d) overflow"
 813                     " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
 814                     tcp->tcp_conn_req_cnt_q0,
 815                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
 816         }
 817 
 818         TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
 819 
 820         /* Put a reference on the conn as we are enqueueing it in the sqeue */
 821         CONN_INC_REF(eager->tcp_connp);
 822 
 823         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
 824             tcp_clean_death_wrapper, eager->tcp_connp, NULL,
 825             SQ_FILL, SQTAG_TCP_DROP_Q0);
 826 
 827         return (B_TRUE);
 828 }
 829 
 830 /*
 831  * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
 832  */
 833 static mblk_t *
 834 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
 835     ip_recv_attr_t *ira)
 836 {
 837         tcp_t           *ltcp = lconnp->conn_tcp;
 838         tcp_t           *tcp = connp->conn_tcp;
 839         mblk_t          *tpi_mp;
 840         ipha_t          *ipha;
 841         ip6_t           *ip6h;
 842         sin6_t          sin6;
 843         uint_t          ifindex = ira->ira_ruifindex;
 844         tcp_stack_t     *tcps = tcp->tcp_tcps;
 845 
 846         if (ira->ira_flags & IRAF_IS_IPV4) {
 847                 ipha = (ipha_t *)mp->b_rptr;
 848 
 849                 connp->conn_ipversion = IPV4_VERSION;
 850                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
 851                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
 852                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
 853 
 854                 sin6 = sin6_null;
 855                 sin6.sin6_addr = connp->conn_faddr_v6;
 856                 sin6.sin6_port = connp->conn_fport;
 857                 sin6.sin6_family = AF_INET6;
 858                 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
 859                     IPCL_ZONEID(lconnp), tcps->tcps_netstack);
 860 
 861                 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
 862                         sin6_t  sin6d;
 863 
 864                         sin6d = sin6_null;
 865                         sin6d.sin6_addr = connp->conn_laddr_v6;
 866                         sin6d.sin6_port = connp->conn_lport;
 867                         sin6d.sin6_family = AF_INET;
 868                         tpi_mp = mi_tpi_extconn_ind(NULL,
 869                             (char *)&sin6d, sizeof (sin6_t),
 870                             (char *)&tcp,
 871                             (t_scalar_t)sizeof (intptr_t),
 872                             (char *)&sin6d, sizeof (sin6_t),
 873                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 874                 } else {
 875                         tpi_mp = mi_tpi_conn_ind(NULL,
 876                             (char *)&sin6, sizeof (sin6_t),
 877                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 878                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 879                 }
 880         } else {
 881                 ip6h = (ip6_t *)mp->b_rptr;
 882 
 883                 connp->conn_ipversion = IPV6_VERSION;
 884                 connp->conn_laddr_v6 = ip6h->ip6_dst;
 885                 connp->conn_faddr_v6 = ip6h->ip6_src;
 886                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
 887 
 888                 sin6 = sin6_null;
 889                 sin6.sin6_addr = connp->conn_faddr_v6;
 890                 sin6.sin6_port = connp->conn_fport;
 891                 sin6.sin6_family = AF_INET6;
 892                 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
 893                 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
 894                     IPCL_ZONEID(lconnp), tcps->tcps_netstack);
 895 
 896                 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
 897                         /* Pass up the scope_id of remote addr */
 898                         sin6.sin6_scope_id = ifindex;
 899                 } else {
 900                         sin6.sin6_scope_id = 0;
 901                 }
 902                 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
 903                         sin6_t  sin6d;
 904 
 905                         sin6d = sin6_null;
 906                         sin6.sin6_addr = connp->conn_laddr_v6;
 907                         sin6d.sin6_port = connp->conn_lport;
 908                         sin6d.sin6_family = AF_INET6;
 909                         if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
 910                                 sin6d.sin6_scope_id = ifindex;
 911 
 912                         tpi_mp = mi_tpi_extconn_ind(NULL,
 913                             (char *)&sin6d, sizeof (sin6_t),
 914                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 915                             (char *)&sin6d, sizeof (sin6_t),
 916                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 917                 } else {
 918                         tpi_mp = mi_tpi_conn_ind(NULL,
 919                             (char *)&sin6, sizeof (sin6_t),
 920                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 921                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 922                 }
 923         }
 924 
 925         tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
 926         return (tpi_mp);
 927 }
 928 
 929 /* Handle a SYN on an AF_INET socket */
 930 static mblk_t *
 931 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
 932     ip_recv_attr_t *ira)
 933 {
 934         tcp_t           *ltcp = lconnp->conn_tcp;
 935         tcp_t           *tcp = connp->conn_tcp;
 936         sin_t           sin;
 937         mblk_t          *tpi_mp = NULL;
 938         tcp_stack_t     *tcps = tcp->tcp_tcps;
 939         ipha_t          *ipha;
 940 
 941         ASSERT(ira->ira_flags & IRAF_IS_IPV4);
 942         ipha = (ipha_t *)mp->b_rptr;
 943 
 944         connp->conn_ipversion = IPV4_VERSION;
 945         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
 946         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
 947         connp->conn_saddr_v6 = connp->conn_laddr_v6;
 948 
 949         sin = sin_null;
 950         sin.sin_addr.s_addr = connp->conn_faddr_v4;
 951         sin.sin_port = connp->conn_fport;
 952         sin.sin_family = AF_INET;
 953         if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
 954                 sin_t   sind;
 955 
 956                 sind = sin_null;
 957                 sind.sin_addr.s_addr = connp->conn_laddr_v4;
 958                 sind.sin_port = connp->conn_lport;
 959                 sind.sin_family = AF_INET;
 960                 tpi_mp = mi_tpi_extconn_ind(NULL,
 961                     (char *)&sind, sizeof (sin_t), (char *)&tcp,
 962                     (t_scalar_t)sizeof (intptr_t), (char *)&sind,
 963                     sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 964         } else {
 965                 tpi_mp = mi_tpi_conn_ind(NULL,
 966                     (char *)&sin, sizeof (sin_t),
 967                     (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 968                     (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 969         }
 970 
 971         tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
 972         return (tpi_mp);
 973 }
 974 
 975 /*
 976  * Called via squeue to get on to eager's perimeter. It sends a
 977  * TH_RST if eager is in the fanout table. The listener wants the
 978  * eager to disappear either by means of tcp_eager_blowoff() or
 979  * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
 980  * called (via squeue) if the eager cannot be inserted in the
 981  * fanout table in tcp_input_listener().
 982  */
 983 /* ARGSUSED */
 984 void
 985 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
 986 {
 987         conn_t  *econnp = (conn_t *)arg;
 988         tcp_t   *eager = econnp->conn_tcp;
 989         tcp_t   *listener = eager->tcp_listener;
 990 
 991         /*
 992          * We could be called because listener is closing. Since
 993          * the eager was using listener's queue's, we avoid
 994          * using the listeners queues from now on.
 995          */
 996         ASSERT(eager->tcp_detached);
 997         econnp->conn_rq = NULL;
 998         econnp->conn_wq = NULL;
 999 
1000         /*
1001          * An eager's conn_fanout will be NULL if it's a duplicate
1002          * for an existing 4-tuples in the conn fanout table.
1003          * We don't want to send an RST out in such case.
1004          */
1005         if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1006                 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1007                     eager, eager->tcp_snxt, 0, TH_RST);
1008         }
1009 
1010         /* We are here because listener wants this eager gone */
1011         if (listener != NULL) {
1012                 mutex_enter(&listener->tcp_eager_lock);
1013                 tcp_eager_unlink(eager);
1014                 if (eager->tcp_tconnind_started) {
1015                         /*
1016                          * The eager has sent a conn_ind up to the
1017                          * listener but listener decides to close
1018                          * instead. We need to drop the extra ref
1019                          * placed on eager in tcp_input_data() before
1020                          * sending the conn_ind to listener.
1021                          */
1022                         CONN_DEC_REF(econnp);
1023                 }
1024                 mutex_exit(&listener->tcp_eager_lock);
1025                 CONN_DEC_REF(listener->tcp_connp);
1026         }
1027 
1028         if (eager->tcp_state != TCPS_CLOSED)
1029                 tcp_close_detached(eager);
1030 }
1031 
1032 /*
1033  * Reset any eager connection hanging off this listener marked
1034  * with 'seqnum' and then reclaim it's resources.
1035  */
1036 boolean_t
1037 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1038 {
1039         tcp_t   *eager;
1040         mblk_t  *mp;
1041 
1042         eager = listener;
1043         mutex_enter(&listener->tcp_eager_lock);
1044         do {
1045                 eager = eager->tcp_eager_next_q;
1046                 if (eager == NULL) {
1047                         mutex_exit(&listener->tcp_eager_lock);
1048                         return (B_FALSE);
1049                 }
1050         } while (eager->tcp_conn_req_seqnum != seqnum);
1051 
1052         if (eager->tcp_closemp_used) {
1053                 mutex_exit(&listener->tcp_eager_lock);
1054                 return (B_TRUE);
1055         }
1056         eager->tcp_closemp_used = B_TRUE;
1057         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1058         CONN_INC_REF(eager->tcp_connp);
1059         mutex_exit(&listener->tcp_eager_lock);
1060         mp = &eager->tcp_closemp;
1061         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1062             eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1063         return (B_TRUE);
1064 }
1065 
1066 /*
1067  * Reset any eager connection hanging off this listener
1068  * and then reclaim it's resources.
1069  */
1070 void
1071 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1072 {
1073         tcp_t   *eager;
1074         mblk_t  *mp;
1075         tcp_stack_t     *tcps = listener->tcp_tcps;
1076 
1077         ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1078 
1079         if (!q0_only) {
1080                 /* First cleanup q */
1081                 TCP_STAT(tcps, tcp_eager_blowoff_q);
1082                 eager = listener->tcp_eager_next_q;
1083                 while (eager != NULL) {
1084                         if (!eager->tcp_closemp_used) {
1085                                 eager->tcp_closemp_used = B_TRUE;
1086                                 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1087                                 CONN_INC_REF(eager->tcp_connp);
1088                                 mp = &eager->tcp_closemp;
1089                                 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1090                                     tcp_eager_kill, eager->tcp_connp, NULL,
1091                                     SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1092                         }
1093                         eager = eager->tcp_eager_next_q;
1094                 }
1095         }
1096         /* Then cleanup q0 */
1097         TCP_STAT(tcps, tcp_eager_blowoff_q0);
1098         eager = listener->tcp_eager_next_q0;
1099         while (eager != listener) {
1100                 if (!eager->tcp_closemp_used) {
1101                         eager->tcp_closemp_used = B_TRUE;
1102                         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1103                         CONN_INC_REF(eager->tcp_connp);
1104                         mp = &eager->tcp_closemp;
1105                         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1106                             tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1107                             SQTAG_TCP_EAGER_CLEANUP_Q0);
1108                 }
1109                 eager = eager->tcp_eager_next_q0;
1110         }
1111 }
1112 
1113 /*
1114  * If we are an eager connection hanging off a listener that hasn't
1115  * formally accepted the connection yet, get off his list and blow off
1116  * any data that we have accumulated.
1117  */
1118 void
1119 tcp_eager_unlink(tcp_t *tcp)
1120 {
1121         tcp_t   *listener = tcp->tcp_listener;
1122 
1123         ASSERT(listener != NULL);
1124         ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1125         if (tcp->tcp_eager_next_q0 != NULL) {
1126                 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1127 
1128                 /* Remove the eager tcp from q0 */
1129                 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1130                     tcp->tcp_eager_prev_q0;
1131                 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1132                     tcp->tcp_eager_next_q0;
1133                 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1134                 listener->tcp_conn_req_cnt_q0--;
1135 
1136                 tcp->tcp_eager_next_q0 = NULL;
1137                 tcp->tcp_eager_prev_q0 = NULL;
1138 
1139                 /*
1140                  * Take the eager out, if it is in the list of droppable
1141                  * eagers.
1142                  */
1143                 MAKE_UNDROPPABLE(tcp);
1144 
1145                 if (tcp->tcp_syn_rcvd_timeout != 0) {
1146                         /* we have timed out before */
1147                         ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1148                         listener->tcp_syn_rcvd_timeout--;
1149                 }
1150         } else {
1151                 tcp_t   **tcpp = &listener->tcp_eager_next_q;
1152                 tcp_t   *prev = NULL;
1153 
1154                 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1155                         if (tcpp[0] == tcp) {
1156                                 if (listener->tcp_eager_last_q == tcp) {
1157                                         /*
1158                                          * If we are unlinking the last
1159                                          * element on the list, adjust
1160                                          * tail pointer. Set tail pointer
1161                                          * to nil when list is empty.
1162                                          */
1163                                         ASSERT(tcp->tcp_eager_next_q == NULL);
1164                                         if (listener->tcp_eager_last_q ==
1165                                             listener->tcp_eager_next_q) {
1166                                                 listener->tcp_eager_last_q =
1167                                                     NULL;
1168                                         } else {
1169                                                 /*
1170                                                  * We won't get here if there
1171                                                  * is only one eager in the
1172                                                  * list.
1173                                                  */
1174                                                 ASSERT(prev != NULL);
1175                                                 listener->tcp_eager_last_q =
1176                                                     prev;
1177                                         }
1178                                 }
1179                                 tcpp[0] = tcp->tcp_eager_next_q;
1180                                 tcp->tcp_eager_next_q = NULL;
1181                                 tcp->tcp_eager_last_q = NULL;
1182                                 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1183                                 listener->tcp_conn_req_cnt_q--;
1184                                 break;
1185                         }
1186                         prev = tcpp[0];
1187                 }
1188         }
1189         tcp->tcp_listener = NULL;
1190 }
1191 
1192 /* BEGIN CSTYLED */
1193 /*
1194  *
1195  * The sockfs ACCEPT path:
1196  * =======================
1197  *
1198  * The eager is now established in its own perimeter as soon as SYN is
1199  * received in tcp_input_listener(). When sockfs receives conn_ind, it
1200  * completes the accept processing on the acceptor STREAM. The sending
1201  * of conn_ind part is common for both sockfs listener and a TLI/XTI
1202  * listener but a TLI/XTI listener completes the accept processing
1203  * on the listener perimeter.
1204  *
1205  * Common control flow for 3 way handshake:
1206  * ----------------------------------------
1207  *
1208  * incoming SYN (listener perimeter)    -> tcp_input_listener()
1209  *
1210  * incoming SYN-ACK-ACK (eager perim)   -> tcp_input_data()
1211  * send T_CONN_IND (listener perim)     -> tcp_send_conn_ind()
1212  *
1213  * Sockfs ACCEPT Path:
1214  * -------------------
1215  *
1216  * open acceptor stream (tcp_open allocates tcp_tli_accept()
1217  * as STREAM entry point)
1218  *
1219  * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1220  *
1221  * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1222  * association (we are not behind eager's squeue but sockfs is protecting us
1223  * and no one knows about this stream yet. The STREAMS entry point q->q_info
1224  * is changed to point at tcp_wput().
1225  *
1226  * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1227  * listener (done on listener's perimeter).
1228  *
1229  * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1230  * accept.
1231  *
1232  * TLI/XTI client ACCEPT path:
1233  * ---------------------------
1234  *
1235  * soaccept() sends T_CONN_RES on the listener STREAM.
1236  *
1237  * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1238  * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1239  *
1240  * Locks:
1241  * ======
1242  *
1243  * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1244  * and listeners->tcp_eager_next_q.
1245  *
1246  * Referencing:
1247  * ============
1248  *
1249  * 1) We start out in tcp_input_listener by eager placing a ref on
1250  * listener and listener adding eager to listeners->tcp_eager_next_q0.
1251  *
1252  * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1253  * doing so we place a ref on the eager. This ref is finally dropped at the
1254  * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1255  * reference is dropped by the squeue framework.
1256  *
1257  * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1258  *
1259  * The reference must be released by the same entity that added the reference
1260  * In the above scheme, the eager is the entity that adds and releases the
1261  * references. Note that tcp_accept_finish executes in the squeue of the eager
1262  * (albeit after it is attached to the acceptor stream). Though 1. executes
1263  * in the listener's squeue, the eager is nascent at this point and the
1264  * reference can be considered to have been added on behalf of the eager.
1265  *
1266  * Eager getting a Reset or listener closing:
1267  * ==========================================
1268  *
1269  * Once the listener and eager are linked, the listener never does the unlink.
1270  * If the listener needs to close, tcp_eager_cleanup() is called which queues
1271  * a message on all eager perimeter. The eager then does the unlink, clears
1272  * any pointers to the listener's queue and drops the reference to the
1273  * listener. The listener waits in tcp_close outside the squeue until its
1274  * refcount has dropped to 1. This ensures that the listener has waited for
1275  * all eagers to clear their association with the listener.
1276  *
1277  * Similarly, if eager decides to go away, it can unlink itself and close.
1278  * When the T_CONN_RES comes down, we check if eager has closed. Note that
1279  * the reference to eager is still valid because of the extra ref we put
1280  * in tcp_send_conn_ind.
1281  *
1282  * Listener can always locate the eager under the protection
1283  * of the listener->tcp_eager_lock, and then do a refhold
1284  * on the eager during the accept processing.
1285  *
1286  * The acceptor stream accesses the eager in the accept processing
1287  * based on the ref placed on eager before sending T_conn_ind.
1288  * The only entity that can negate this refhold is a listener close
1289  * which is mutually exclusive with an active acceptor stream.
1290  *
1291  * Eager's reference on the listener
1292  * ===================================
1293  *
1294  * If the accept happens (even on a closed eager) the eager drops its
1295  * reference on the listener at the start of tcp_accept_finish. If the
1296  * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1297  * the reference is dropped in tcp_closei_local. If the listener closes,
1298  * the reference is dropped in tcp_eager_kill. In all cases the reference
1299  * is dropped while executing in the eager's context (squeue).
1300  */
1301 /* END CSTYLED */
1302 
1303 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1304 
1305 /*
1306  * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1307  * tcp_input_data will not see any packets for listeners since the listener
1308  * has conn_recv set to tcp_input_listener.
1309  */
1310 /* ARGSUSED */
1311 static void
1312 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1313 {
1314         tcpha_t         *tcpha;
1315         uint32_t        seg_seq;
1316         tcp_t           *eager;
1317         int             err;
1318         conn_t          *econnp = NULL;
1319         squeue_t        *new_sqp;
1320         mblk_t          *mp1;
1321         uint_t          ip_hdr_len;
1322         conn_t          *lconnp = (conn_t *)arg;
1323         tcp_t           *listener = lconnp->conn_tcp;
1324         tcp_stack_t     *tcps = listener->tcp_tcps;
1325         ip_stack_t      *ipst = tcps->tcps_netstack->netstack_ip;
1326         uint_t          flags;
1327         mblk_t          *tpi_mp;
1328         uint_t          ifindex = ira->ira_ruifindex;
1329         boolean_t       tlc_set = B_FALSE;
1330 
1331         ip_hdr_len = ira->ira_ip_hdr_length;
1332         tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1333         flags = (unsigned int)tcpha->tha_flags & 0xFF;
1334 
1335         DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1336             __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1337             __dtrace_tcp_tcph_t *, tcpha);
1338 
1339         if (!(flags & TH_SYN)) {
1340                 if ((flags & TH_RST) || (flags & TH_URG)) {
1341                         freemsg(mp);
1342                         return;
1343                 }
1344                 if (flags & TH_ACK) {
1345                         /* Note this executes in listener's squeue */
1346                         tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1347                         return;
1348                 }
1349 
1350                 freemsg(mp);
1351                 return;
1352         }
1353 
1354         if (listener->tcp_state != TCPS_LISTEN)
1355                 goto error2;
1356 
1357         ASSERT(IPCL_IS_BOUND(lconnp));
1358 
1359         mutex_enter(&listener->tcp_eager_lock);
1360 
1361         /*
1362          * The system is under memory pressure, so we need to do our part
1363          * to relieve the pressure.  So we only accept new request if there
1364          * is nothing waiting to be accepted or waiting to complete the 3-way
1365          * handshake.  This means that busy listener will not get too many
1366          * new requests which they cannot handle in time while non-busy
1367          * listener is still functioning properly.
1368          */
1369         if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1370             listener->tcp_conn_req_cnt_q0 > 0)) {
1371                 mutex_exit(&listener->tcp_eager_lock);
1372                 TCP_STAT(tcps, tcp_listen_mem_drop);
1373                 goto error2;
1374         }
1375 
1376         if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1377                 mutex_exit(&listener->tcp_eager_lock);
1378                 TCP_STAT(tcps, tcp_listendrop);
1379                 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1380                 if (lconnp->conn_debug) {
1381                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1382                             "tcp_input_listener: listen backlog (max=%d) "
1383                             "overflow (%d pending) on %s",
1384                             listener->tcp_conn_req_max,
1385                             listener->tcp_conn_req_cnt_q,
1386                             tcp_display(listener, NULL, DISP_PORT_ONLY));
1387                 }
1388                 goto error2;
1389         }
1390 
1391         if (listener->tcp_conn_req_cnt_q0 >=
1392             listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1393                 /*
1394                  * Q0 is full. Drop a pending half-open req from the queue
1395                  * to make room for the new SYN req. Also mark the time we
1396                  * drop a SYN.
1397                  *
1398                  * A more aggressive defense against SYN attack will
1399                  * be to set the "tcp_syn_defense" flag now.
1400                  */
1401                 TCP_STAT(tcps, tcp_listendropq0);
1402                 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1403                 if (!tcp_drop_q0(listener)) {
1404                         mutex_exit(&listener->tcp_eager_lock);
1405                         TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1406                         if (lconnp->conn_debug) {
1407                                 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1408                                     "tcp_input_listener: listen half-open "
1409                                     "queue (max=%d) full (%d pending) on %s",
1410                                     tcps->tcps_conn_req_max_q0,
1411                                     listener->tcp_conn_req_cnt_q0,
1412                                     tcp_display(listener, NULL,
1413                                     DISP_PORT_ONLY));
1414                         }
1415                         goto error2;
1416                 }
1417         }
1418 
1419         /*
1420          * Enforce the limit set on the number of connections per listener.
1421          * Note that tlc_cnt starts with 1.  So need to add 1 to tlc_max
1422          * for comparison.
1423          */
1424         if (listener->tcp_listen_cnt != NULL) {
1425                 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1426                 int64_t now;
1427 
1428                 if (atomic_add_32_nv(&tlc->tlc_cnt, 1) > tlc->tlc_max + 1) {
1429                         mutex_exit(&listener->tcp_eager_lock);
1430                         now = ddi_get_lbolt64();
1431                         atomic_add_32(&tlc->tlc_cnt, -1);
1432                         TCP_STAT(tcps, tcp_listen_cnt_drop);
1433                         tlc->tlc_drop++;
1434                         if (now - tlc->tlc_report_time >
1435                             MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1436                                 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1437                                     "Listener (port %d) connection max (%u) "
1438                                     "reached: %u attempts dropped total\n",
1439                                     ntohs(listener->tcp_connp->conn_lport),
1440                                     tlc->tlc_max, tlc->tlc_drop);
1441                                 tlc->tlc_report_time = now;
1442                         }
1443                         goto error2;
1444                 }
1445                 tlc_set = B_TRUE;
1446         }
1447 
1448         mutex_exit(&listener->tcp_eager_lock);
1449 
1450         /*
1451          * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1452          * or based on the ring (for packets from GLD). Otherwise it is
1453          * set based on lbolt i.e., a somewhat random number.
1454          */
1455         ASSERT(ira->ira_sqp != NULL);
1456         new_sqp = ira->ira_sqp;
1457 
1458         econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1459         if (econnp == NULL)
1460                 goto error2;
1461 
1462         ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1463         econnp->conn_sqp = new_sqp;
1464         econnp->conn_initial_sqp = new_sqp;
1465         econnp->conn_ixa->ixa_sqp = new_sqp;
1466 
1467         econnp->conn_fport = tcpha->tha_lport;
1468         econnp->conn_lport = tcpha->tha_fport;
1469 
1470         err = conn_inherit_parent(lconnp, econnp);
1471         if (err != 0)
1472                 goto error3;
1473 
1474         /* We already know the laddr of the new connection is ours */
1475         econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1476 
1477         ASSERT(OK_32PTR(mp->b_rptr));
1478         ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1479             IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1480 
1481         if (lconnp->conn_family == AF_INET) {
1482                 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1483                 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1484         } else {
1485                 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1486         }
1487 
1488         if (tpi_mp == NULL)
1489                 goto error3;
1490 
1491         eager = econnp->conn_tcp;
1492         eager->tcp_detached = B_TRUE;
1493         SOCK_CONNID_INIT(eager->tcp_connid);
1494 
1495         /*
1496          * Initialize the eager's tcp_t and inherit some parameters from
1497          * the listener.
1498          */
1499         tcp_init_values(eager, listener);
1500 
1501         ASSERT((econnp->conn_ixa->ixa_flags &
1502             (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1503             IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1504             (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1505             IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1506 
1507         if (!tcps->tcps_dev_flow_ctl)
1508                 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1509 
1510         /* Prepare for diffing against previous packets */
1511         eager->tcp_recvifindex = 0;
1512         eager->tcp_recvhops = 0xffffffffU;
1513 
1514         if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1515                 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1516                     IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1517                         econnp->conn_incoming_ifindex = ifindex;
1518                         econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1519                         econnp->conn_ixa->ixa_scopeid = ifindex;
1520                 }
1521         }
1522 
1523         if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1524             (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1525             tcps->tcps_rev_src_routes) {
1526                 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1527                 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1528 
1529                 /* Source routing option copyover (reverse it) */
1530                 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1531                 if (err != 0) {
1532                         freemsg(tpi_mp);
1533                         goto error3;
1534                 }
1535                 ip_pkt_source_route_reverse_v4(ipp);
1536         }
1537 
1538         ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1539         ASSERT(!eager->tcp_tconnind_started);
1540         /*
1541          * If the SYN came with a credential, it's a loopback packet or a
1542          * labeled packet; attach the credential to the TPI message.
1543          */
1544         if (ira->ira_cred != NULL)
1545                 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1546 
1547         eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1548         ASSERT(eager->tcp_ordrel_mp == NULL);
1549 
1550         /* Inherit the listener's non-STREAMS flag */
1551         if (IPCL_IS_NONSTR(lconnp)) {
1552                 econnp->conn_flags |= IPCL_NONSTR;
1553                 /* All non-STREAMS tcp_ts are sockets */
1554                 eager->tcp_issocket = B_TRUE;
1555         } else {
1556                 /*
1557                  * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1558                  * at close time, we will always have that to send up.
1559                  * Otherwise, we need to do special handling in case the
1560                  * allocation fails at that time.
1561                  */
1562                 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1563                         goto error3;
1564         }
1565         /*
1566          * Now that the IP addresses and ports are setup in econnp we
1567          * can do the IPsec policy work.
1568          */
1569         if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1570                 if (lconnp->conn_policy != NULL) {
1571                         /*
1572                          * Inherit the policy from the listener; use
1573                          * actions from ira
1574                          */
1575                         if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1576                                 CONN_DEC_REF(econnp);
1577                                 freemsg(mp);
1578                                 goto error3;
1579                         }
1580                 }
1581         }
1582 
1583         /*
1584          * tcp_set_destination() may set tcp_rwnd according to the route
1585          * metrics. If it does not, the eager's receive window will be set
1586          * to the listener's receive window later in this function.
1587          */
1588         eager->tcp_rwnd = 0;
1589 
1590         if (is_system_labeled()) {
1591                 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1592 
1593                 ASSERT(ira->ira_tsl != NULL);
1594                 /* Discard any old label */
1595                 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1596                         ASSERT(ixa->ixa_tsl != NULL);
1597                         label_rele(ixa->ixa_tsl);
1598                         ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1599                         ixa->ixa_tsl = NULL;
1600                 }
1601                 if ((lconnp->conn_mlp_type != mlptSingle ||
1602                     lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1603                     ira->ira_tsl != NULL) {
1604                         /*
1605                          * If this is an MLP connection or a MAC-Exempt
1606                          * connection with an unlabeled node, packets are to be
1607                          * exchanged using the security label of the received
1608                          * SYN packet instead of the server application's label.
1609                          * tsol_check_dest called from ip_set_destination
1610                          * might later update TSF_UNLABELED by replacing
1611                          * ixa_tsl with a new label.
1612                          */
1613                         label_hold(ira->ira_tsl);
1614                         ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1615                         DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1616                             econnp, ts_label_t *, ixa->ixa_tsl)
1617                 } else {
1618                         ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1619                         DTRACE_PROBE2(syn_accept, conn_t *,
1620                             econnp, ts_label_t *, ixa->ixa_tsl)
1621                 }
1622                 /*
1623                  * conn_connect() called from tcp_set_destination will verify
1624                  * the destination is allowed to receive packets at the
1625                  * security label of the SYN-ACK we are generating. As part of
1626                  * that, tsol_check_dest() may create a new effective label for
1627                  * this connection.
1628                  * Finally conn_connect() will call conn_update_label.
1629                  * All that remains for TCP to do is to call
1630                  * conn_build_hdr_template which is done as part of
1631                  * tcp_set_destination.
1632                  */
1633         }
1634 
1635         /*
1636          * Since we will clear tcp_listener before we clear tcp_detached
1637          * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1638          * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1639          */
1640         eager->tcp_hard_binding = B_TRUE;
1641 
1642         tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1643             TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1644 
1645         CL_INET_CONNECT(econnp, B_FALSE, err);
1646         if (err != 0) {
1647                 tcp_bind_hash_remove(eager);
1648                 goto error3;
1649         }
1650 
1651         SOCK_CONNID_BUMP(eager->tcp_connid);
1652 
1653         /*
1654          * Adapt our mss, ttl, ... based on the remote address.
1655          */
1656 
1657         if (tcp_set_destination(eager) != 0) {
1658                 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1659                 /* Undo the bind_hash_insert */
1660                 tcp_bind_hash_remove(eager);
1661                 goto error3;
1662         }
1663 
1664         /* Process all TCP options. */
1665         tcp_process_options(eager, tcpha);
1666 
1667         /* Is the other end ECN capable? */
1668         if (tcps->tcps_ecn_permitted >= 1 &&
1669             (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1670                 eager->tcp_ecn_ok = B_TRUE;
1671         }
1672 
1673         /*
1674          * The listener's conn_rcvbuf should be the default window size or a
1675          * window size changed via SO_RCVBUF option. First round up the
1676          * eager's tcp_rwnd to the nearest MSS. Then find out the window
1677          * scale option value if needed. Call tcp_rwnd_set() to finish the
1678          * setting.
1679          *
1680          * Note if there is a rpipe metric associated with the remote host,
1681          * we should not inherit receive window size from listener.
1682          */
1683         eager->tcp_rwnd = MSS_ROUNDUP(
1684             (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1685             eager->tcp_rwnd), eager->tcp_mss);
1686         if (eager->tcp_snd_ws_ok)
1687                 tcp_set_ws_value(eager);
1688         /*
1689          * Note that this is the only place tcp_rwnd_set() is called for
1690          * accepting a connection.  We need to call it here instead of
1691          * after the 3-way handshake because we need to tell the other
1692          * side our rwnd in the SYN-ACK segment.
1693          */
1694         (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1695 
1696         ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1697             eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1698 
1699         ASSERT(econnp->conn_rcvbuf != 0 &&
1700             econnp->conn_rcvbuf == eager->tcp_rwnd);
1701 
1702         /* Put a ref on the listener for the eager. */
1703         CONN_INC_REF(lconnp);
1704         mutex_enter(&listener->tcp_eager_lock);
1705         listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1706         eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1707         listener->tcp_eager_next_q0 = eager;
1708         eager->tcp_eager_prev_q0 = listener;
1709 
1710         /* Set tcp_listener before adding it to tcp_conn_fanout */
1711         eager->tcp_listener = listener;
1712         eager->tcp_saved_listener = listener;
1713 
1714         /*
1715          * Set tcp_listen_cnt so that when the connection is done, the counter
1716          * is decremented.
1717          */
1718         eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1719 
1720         /*
1721          * Tag this detached tcp vector for later retrieval
1722          * by our listener client in tcp_accept().
1723          */
1724         eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1725         listener->tcp_conn_req_cnt_q0++;
1726         if (++listener->tcp_conn_req_seqnum == -1) {
1727                 /*
1728                  * -1 is "special" and defined in TPI as something
1729                  * that should never be used in T_CONN_IND
1730                  */
1731                 ++listener->tcp_conn_req_seqnum;
1732         }
1733         mutex_exit(&listener->tcp_eager_lock);
1734 
1735         if (listener->tcp_syn_defense) {
1736                 /* Don't drop the SYN that comes from a good IP source */
1737                 ipaddr_t *addr_cache;
1738 
1739                 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1740                 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1741                     addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1742                         eager->tcp_dontdrop = B_TRUE;
1743                 }
1744         }
1745 
1746         /*
1747          * We need to insert the eager in its own perimeter but as soon
1748          * as we do that, we expose the eager to the classifier and
1749          * should not touch any field outside the eager's perimeter.
1750          * So do all the work necessary before inserting the eager
1751          * in its own perimeter. Be optimistic that conn_connect()
1752          * will succeed but undo everything if it fails.
1753          */
1754         seg_seq = ntohl(tcpha->tha_seq);
1755         eager->tcp_irs = seg_seq;
1756         eager->tcp_rack = seg_seq;
1757         eager->tcp_rnxt = seg_seq + 1;
1758         eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1759         TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1760         eager->tcp_state = TCPS_SYN_RCVD;
1761         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1762             econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1763             int32_t, TCPS_LISTEN);
1764 
1765         mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1766             NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1767         if (mp1 == NULL) {
1768                 /*
1769                  * Increment the ref count as we are going to
1770                  * enqueueing an mp in squeue
1771                  */
1772                 CONN_INC_REF(econnp);
1773                 goto error;
1774         }
1775 
1776         /*
1777          * We need to start the rto timer. In normal case, we start
1778          * the timer after sending the packet on the wire (or at
1779          * least believing that packet was sent by waiting for
1780          * conn_ip_output() to return). Since this is the first packet
1781          * being sent on the wire for the eager, our initial tcp_rto
1782          * is at least tcp_rexmit_interval_min which is a fairly
1783          * large value to allow the algorithm to adjust slowly to large
1784          * fluctuations of RTT during first few transmissions.
1785          *
1786          * Starting the timer first and then sending the packet in this
1787          * case shouldn't make much difference since tcp_rexmit_interval_min
1788          * is of the order of several 100ms and starting the timer
1789          * first and then sending the packet will result in difference
1790          * of few micro seconds.
1791          *
1792          * Without this optimization, we are forced to hold the fanout
1793          * lock across the ipcl_bind_insert() and sending the packet
1794          * so that we don't race against an incoming packet (maybe RST)
1795          * for this eager.
1796          *
1797          * It is necessary to acquire an extra reference on the eager
1798          * at this point and hold it until after tcp_send_data() to
1799          * ensure against an eager close race.
1800          */
1801 
1802         CONN_INC_REF(econnp);
1803 
1804         TCP_TIMER_RESTART(eager, eager->tcp_rto);
1805 
1806         /*
1807          * Insert the eager in its own perimeter now. We are ready to deal
1808          * with any packets on eager.
1809          */
1810         if (ipcl_conn_insert(econnp) != 0)
1811                 goto error;
1812 
1813         ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1814         freemsg(mp);
1815         /*
1816          * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1817          * only used by one thread at a time.
1818          */
1819         if (econnp->conn_sqp == lconnp->conn_sqp) {
1820                 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1821                     econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1822                     tcp_t *, eager, __dtrace_tcp_tcph_t *,
1823                     &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1824                 (void) conn_ip_output(mp1, econnp->conn_ixa);
1825                 CONN_DEC_REF(econnp);
1826         } else {
1827                 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1828                     econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1829         }
1830         return;
1831 error:
1832         freemsg(mp1);
1833         eager->tcp_closemp_used = B_TRUE;
1834         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1835         mp1 = &eager->tcp_closemp;
1836         SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1837             econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1838 
1839         /*
1840          * If a connection already exists, send the mp to that connections so
1841          * that it can be appropriately dealt with.
1842          */
1843         ipst = tcps->tcps_netstack->netstack_ip;
1844 
1845         if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1846                 if (!IPCL_IS_CONNECTED(econnp)) {
1847                         /*
1848                          * Something bad happened. ipcl_conn_insert()
1849                          * failed because a connection already existed
1850                          * in connected hash but we can't find it
1851                          * anymore (someone blew it away). Just
1852                          * free this message and hopefully remote
1853                          * will retransmit at which time the SYN can be
1854                          * treated as a new connection or dealth with
1855                          * a TH_RST if a connection already exists.
1856                          */
1857                         CONN_DEC_REF(econnp);
1858                         freemsg(mp);
1859                 } else {
1860                         SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1861                             econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1862                 }
1863         } else {
1864                 /* Nobody wants this packet */
1865                 freemsg(mp);
1866         }
1867         return;
1868 error3:
1869         CONN_DEC_REF(econnp);
1870 error2:
1871         freemsg(mp);
1872         if (tlc_set)
1873                 atomic_add_32(&listener->tcp_listen_cnt->tlc_cnt, -1);
1874 }
1875 
1876 /*
1877  * In an ideal case of vertical partition in NUMA architecture, its
1878  * beneficial to have the listener and all the incoming connections
1879  * tied to the same squeue. The other constraint is that incoming
1880  * connections should be tied to the squeue attached to interrupted
1881  * CPU for obvious locality reason so this leaves the listener to
1882  * be tied to the same squeue. Our only problem is that when listener
1883  * is binding, the CPU that will get interrupted by the NIC whose
1884  * IP address the listener is binding to is not even known. So
1885  * the code below allows us to change that binding at the time the
1886  * CPU is interrupted by virtue of incoming connection's squeue.
1887  *
1888  * This is usefull only in case of a listener bound to a specific IP
1889  * address. For other kind of listeners, they get bound the
1890  * very first time and there is no attempt to rebind them.
1891  */
1892 void
1893 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1894     ip_recv_attr_t *ira)
1895 {
1896         conn_t          *connp = (conn_t *)arg;
1897         squeue_t        *sqp = (squeue_t *)arg2;
1898         squeue_t        *new_sqp;
1899         uint32_t        conn_flags;
1900 
1901         /*
1902          * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1903          * or based on the ring (for packets from GLD). Otherwise it is
1904          * set based on lbolt i.e., a somewhat random number.
1905          */
1906         ASSERT(ira->ira_sqp != NULL);
1907         new_sqp = ira->ira_sqp;
1908 
1909         if (connp->conn_fanout == NULL)
1910                 goto done;
1911 
1912         if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1913                 mutex_enter(&connp->conn_fanout->connf_lock);
1914                 mutex_enter(&connp->conn_lock);
1915                 /*
1916                  * No one from read or write side can access us now
1917                  * except for already queued packets on this squeue.
1918                  * But since we haven't changed the squeue yet, they
1919                  * can't execute. If they are processed after we have
1920                  * changed the squeue, they are sent back to the
1921                  * correct squeue down below.
1922                  * But a listner close can race with processing of
1923                  * incoming SYN. If incoming SYN processing changes
1924                  * the squeue then the listener close which is waiting
1925                  * to enter the squeue would operate on the wrong
1926                  * squeue. Hence we don't change the squeue here unless
1927                  * the refcount is exactly the minimum refcount. The
1928                  * minimum refcount of 4 is counted as - 1 each for
1929                  * TCP and IP, 1 for being in the classifier hash, and
1930                  * 1 for the mblk being processed.
1931                  */
1932 
1933                 if (connp->conn_ref != 4 ||
1934                     connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1935                         mutex_exit(&connp->conn_lock);
1936                         mutex_exit(&connp->conn_fanout->connf_lock);
1937                         goto done;
1938                 }
1939                 if (connp->conn_sqp != new_sqp) {
1940                         while (connp->conn_sqp != new_sqp)
1941                                 (void) casptr(&connp->conn_sqp, sqp, new_sqp);
1942                         /* No special MT issues for outbound ixa_sqp hint */
1943                         connp->conn_ixa->ixa_sqp = new_sqp;
1944                 }
1945 
1946                 do {
1947                         conn_flags = connp->conn_flags;
1948                         conn_flags |= IPCL_FULLY_BOUND;
1949                         (void) cas32(&connp->conn_flags, connp->conn_flags,
1950                             conn_flags);
1951                 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1952 
1953                 mutex_exit(&connp->conn_fanout->connf_lock);
1954                 mutex_exit(&connp->conn_lock);
1955 
1956                 /*
1957                  * Assume we have picked a good squeue for the listener. Make
1958                  * subsequent SYNs not try to change the squeue.
1959                  */
1960                 connp->conn_recv = tcp_input_listener;
1961         }
1962 
1963 done:
1964         if (connp->conn_sqp != sqp) {
1965                 CONN_INC_REF(connp);
1966                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1967                     ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1968         } else {
1969                 tcp_input_listener(connp, mp, sqp, ira);
1970         }
1971 }
1972 
1973 /*
1974  * Send up all messages queued on tcp_rcv_list.
1975  */
1976 uint_t
1977 tcp_rcv_drain(tcp_t *tcp)
1978 {
1979         mblk_t *mp;
1980         uint_t ret = 0;
1981 #ifdef DEBUG
1982         uint_t cnt = 0;
1983 #endif
1984         queue_t *q = tcp->tcp_connp->conn_rq;
1985 
1986         /* Can't drain on an eager connection */
1987         if (tcp->tcp_listener != NULL)
1988                 return (ret);
1989 
1990         /* Can't be a non-STREAMS connection */
1991         ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1992 
1993         /* No need for the push timer now. */
1994         if (tcp->tcp_push_tid != 0) {
1995                 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1996                 tcp->tcp_push_tid = 0;
1997         }
1998 
1999         /*
2000          * Handle two cases here: we are currently fused or we were
2001          * previously fused and have some urgent data to be delivered
2002          * upstream.  The latter happens because we either ran out of
2003          * memory or were detached and therefore sending the SIGURG was
2004          * deferred until this point.  In either case we pass control
2005          * over to tcp_fuse_rcv_drain() since it may need to complete
2006          * some work.
2007          */
2008         if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2009                 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2010                     &tcp->tcp_fused_sigurg_mp))
2011                         return (ret);
2012         }
2013 
2014         while ((mp = tcp->tcp_rcv_list) != NULL) {
2015                 tcp->tcp_rcv_list = mp->b_next;
2016                 mp->b_next = NULL;
2017 #ifdef DEBUG
2018                 cnt += msgdsize(mp);
2019 #endif
2020                 putnext(q, mp);
2021         }
2022 #ifdef DEBUG
2023         ASSERT(cnt == tcp->tcp_rcv_cnt);
2024 #endif
2025         tcp->tcp_rcv_last_head = NULL;
2026         tcp->tcp_rcv_last_tail = NULL;
2027         tcp->tcp_rcv_cnt = 0;
2028 
2029         if (canputnext(q))
2030                 return (tcp_rwnd_reopen(tcp));
2031 
2032         return (ret);
2033 }
2034 
2035 /*
2036  * Queue data on tcp_rcv_list which is a b_next chain.
2037  * tcp_rcv_last_head/tail is the last element of this chain.
2038  * Each element of the chain is a b_cont chain.
2039  *
2040  * M_DATA messages are added to the current element.
2041  * Other messages are added as new (b_next) elements.
2042  */
2043 void
2044 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2045 {
2046         ASSERT(seg_len == msgdsize(mp));
2047         ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2048 
2049         if (is_system_labeled()) {
2050                 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2051                 /*
2052                  * Provide for protocols above TCP such as RPC. NOPID leaves
2053                  * db_cpid unchanged.
2054                  * The cred could have already been set.
2055                  */
2056                 if (cr != NULL)
2057                         mblk_setcred(mp, cr, NOPID);
2058         }
2059 
2060         if (tcp->tcp_rcv_list == NULL) {
2061                 ASSERT(tcp->tcp_rcv_last_head == NULL);
2062                 tcp->tcp_rcv_list = mp;
2063                 tcp->tcp_rcv_last_head = mp;
2064         } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2065                 tcp->tcp_rcv_last_tail->b_cont = mp;
2066         } else {
2067                 tcp->tcp_rcv_last_head->b_next = mp;
2068                 tcp->tcp_rcv_last_head = mp;
2069         }
2070 
2071         while (mp->b_cont)
2072                 mp = mp->b_cont;
2073 
2074         tcp->tcp_rcv_last_tail = mp;
2075         tcp->tcp_rcv_cnt += seg_len;
2076         tcp->tcp_rwnd -= seg_len;
2077 }
2078 
2079 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2080 mblk_t *
2081 tcp_ack_mp(tcp_t *tcp)
2082 {
2083         uint32_t        seq_no;
2084         tcp_stack_t     *tcps = tcp->tcp_tcps;
2085         conn_t          *connp = tcp->tcp_connp;
2086 
2087         /*
2088          * There are a few cases to be considered while setting the sequence no.
2089          * Essentially, we can come here while processing an unacceptable pkt
2090          * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2091          * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2092          * If we are here for a zero window probe, stick with suna. In all
2093          * other cases, we check if suna + swnd encompasses snxt and set
2094          * the sequence number to snxt, if so. If snxt falls outside the
2095          * window (the receiver probably shrunk its window), we will go with
2096          * suna + swnd, otherwise the sequence no will be unacceptable to the
2097          * receiver.
2098          */
2099         if (tcp->tcp_zero_win_probe) {
2100                 seq_no = tcp->tcp_suna;
2101         } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2102                 ASSERT(tcp->tcp_swnd == 0);
2103                 seq_no = tcp->tcp_snxt;
2104         } else {
2105                 seq_no = SEQ_GT(tcp->tcp_snxt,
2106                     (tcp->tcp_suna + tcp->tcp_swnd)) ?
2107                     (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2108         }
2109 
2110         if (tcp->tcp_valid_bits) {
2111                 /*
2112                  * For the complex case where we have to send some
2113                  * controls (FIN or SYN), let tcp_xmit_mp do it.
2114                  */
2115                 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2116                     NULL, B_FALSE));
2117         } else {
2118                 /* Generate a simple ACK */
2119                 int     data_length;
2120                 uchar_t *rptr;
2121                 tcpha_t *tcpha;
2122                 mblk_t  *mp1;
2123                 int32_t total_hdr_len;
2124                 int32_t tcp_hdr_len;
2125                 int32_t num_sack_blk = 0;
2126                 int32_t sack_opt_len;
2127                 ip_xmit_attr_t *ixa = connp->conn_ixa;
2128 
2129                 /*
2130                  * Allocate space for TCP + IP headers
2131                  * and link-level header
2132                  */
2133                 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2134                         num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2135                             tcp->tcp_num_sack_blk);
2136                         sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2137                             TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2138                         total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2139                         tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2140                 } else {
2141                         total_hdr_len = connp->conn_ht_iphc_len;
2142                         tcp_hdr_len = connp->conn_ht_ulp_len;
2143                 }
2144                 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2145                 if (!mp1)
2146                         return (NULL);
2147 
2148                 /* Update the latest receive window size in TCP header. */
2149                 tcp->tcp_tcpha->tha_win =
2150                     htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2151                 /* copy in prototype TCP + IP header */
2152                 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2153                 mp1->b_rptr = rptr;
2154                 mp1->b_wptr = rptr + total_hdr_len;
2155                 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2156 
2157                 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2158 
2159                 /* Set the TCP sequence number. */
2160                 tcpha->tha_seq = htonl(seq_no);
2161 
2162                 /* Set up the TCP flag field. */
2163                 tcpha->tha_flags = (uchar_t)TH_ACK;
2164                 if (tcp->tcp_ecn_echo_on)
2165                         tcpha->tha_flags |= TH_ECE;
2166 
2167                 tcp->tcp_rack = tcp->tcp_rnxt;
2168                 tcp->tcp_rack_cnt = 0;
2169 
2170                 /* fill in timestamp option if in use */
2171                 if (tcp->tcp_snd_ts_ok) {
2172                         uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2173 
2174                         U32_TO_BE32(llbolt,
2175                             (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2176                         U32_TO_BE32(tcp->tcp_ts_recent,
2177                             (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2178                 }
2179 
2180                 /* Fill in SACK options */
2181                 if (num_sack_blk > 0) {
2182                         uchar_t *wptr = (uchar_t *)tcpha +
2183                             connp->conn_ht_ulp_len;
2184                         sack_blk_t *tmp;
2185                         int32_t i;
2186 
2187                         wptr[0] = TCPOPT_NOP;
2188                         wptr[1] = TCPOPT_NOP;
2189                         wptr[2] = TCPOPT_SACK;
2190                         wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2191                             sizeof (sack_blk_t);
2192                         wptr += TCPOPT_REAL_SACK_LEN;
2193 
2194                         tmp = tcp->tcp_sack_list;
2195                         for (i = 0; i < num_sack_blk; i++) {
2196                                 U32_TO_BE32(tmp[i].begin, wptr);
2197                                 wptr += sizeof (tcp_seq);
2198                                 U32_TO_BE32(tmp[i].end, wptr);
2199                                 wptr += sizeof (tcp_seq);
2200                         }
2201                         tcpha->tha_offset_and_reserved +=
2202                             ((num_sack_blk * 2 + 1) << 4);
2203                 }
2204 
2205                 ixa->ixa_pktlen = total_hdr_len;
2206 
2207                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2208                         ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2209                 } else {
2210                         ip6_t *ip6 = (ip6_t *)rptr;
2211 
2212                         ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2213                 }
2214 
2215                 /*
2216                  * Prime pump for checksum calculation in IP.  Include the
2217                  * adjustment for a source route if any.
2218                  */
2219                 data_length = tcp_hdr_len + connp->conn_sum;
2220                 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2221                 tcpha->tha_sum = htons(data_length);
2222 
2223                 if (tcp->tcp_ip_forward_progress) {
2224                         tcp->tcp_ip_forward_progress = B_FALSE;
2225                         connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2226                 } else {
2227                         connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2228                 }
2229                 return (mp1);
2230         }
2231 }
2232 
2233 /*
2234  * Dummy socket upcalls for if/when the conn_t gets detached from a
2235  * direct-callback sonode via a user-driven close().  Easy to catch with
2236  * DTrace FBT, and should be mostly harmless.
2237  */
2238 
2239 /* ARGSUSED */
2240 static sock_upper_handle_t
2241 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2242     sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2243 {
2244         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2245         return (NULL);
2246 }
2247 
2248 /* ARGSUSED */
2249 static void
2250 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2251     pid_t pid)
2252 {
2253         ASSERT(x == NULL);
2254         /* Normally we'd crhold(cr) and attach it to socket state. */
2255         /* LINTED */
2256 }
2257 
2258 /* ARGSUSED */
2259 static int
2260 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2261 {
2262         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2263         return (-1);
2264 }
2265 
2266 /* ARGSUSED */
2267 static void
2268 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2269 {
2270         ASSERT(x == NULL);
2271         /* We really want this one to be a harmless NOP for now. */
2272         /* LINTED */
2273 }
2274 
2275 /* ARGSUSED */
2276 static ssize_t
2277 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2278     int *error, boolean_t *push)
2279 {
2280         ASSERT(x == NULL);
2281 
2282         /*
2283          * Consume the message, set ESHUTDOWN, and return an error.
2284          * Nobody's home!
2285          */
2286         freemsg(mp);
2287         *error = ESHUTDOWN;
2288         return (-1);
2289 }
2290 
2291 /* ARGSUSED */
2292 static void
2293 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2294 {
2295         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2296 }
2297 
2298 /* ARGSUSED */
2299 static void
2300 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2301 {
2302         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2303 }
2304 
2305 /* ARGSUSED */
2306 static void
2307 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2308 {
2309         ASSERT(x == NULL);
2310         /* Otherwise, this would signal socket state about OOB data. */
2311 }
2312 
2313 /* ARGSUSED */
2314 static void
2315 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2316 {
2317         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2318 }
2319 
2320 /* ARGSUSED */
2321 static void
2322 tcp_dummy_onearg(sock_upper_handle_t x)
2323 {
2324         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2325 }
2326 
2327 static sock_upcalls_t tcp_dummy_upcalls = {
2328         tcp_dummy_newconn,
2329         tcp_dummy_connected,
2330         tcp_dummy_disconnected,
2331         tcp_dummy_opctl,
2332         tcp_dummy_recv,
2333         tcp_dummy_set_proto_props,
2334         tcp_dummy_txq_full,
2335         tcp_dummy_signal_oob,
2336         tcp_dummy_onearg,
2337         tcp_dummy_set_error,
2338         tcp_dummy_onearg
2339 };
2340 
2341 /*
2342  * Handle M_DATA messages from IP. Its called directly from IP via
2343  * squeue for received IP packets.
2344  *
2345  * The first argument is always the connp/tcp to which the mp belongs.
2346  * There are no exceptions to this rule. The caller has already put
2347  * a reference on this connp/tcp and once tcp_input_data() returns,
2348  * the squeue will do the refrele.
2349  *
2350  * The TH_SYN for the listener directly go to tcp_input_listener via
2351  * squeue. ICMP errors go directly to tcp_icmp_input().
2352  *
2353  * sqp: NULL = recursive, sqp != NULL means called from squeue
2354  */
2355 void
2356 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2357 {
2358         int32_t         bytes_acked;
2359         int32_t         gap;
2360         mblk_t          *mp1;
2361         uint_t          flags;
2362         uint32_t        new_swnd = 0;
2363         uchar_t         *iphdr;
2364         uchar_t         *rptr;
2365         int32_t         rgap;
2366         uint32_t        seg_ack;
2367         int             seg_len;
2368         uint_t          ip_hdr_len;
2369         uint32_t        seg_seq;
2370         tcpha_t         *tcpha;
2371         int             urp;
2372         tcp_opt_t       tcpopt;
2373         ip_pkt_t        ipp;
2374         boolean_t       ofo_seg = B_FALSE; /* Out of order segment */
2375         uint32_t        cwnd;
2376         uint32_t        add;
2377         int             npkt;
2378         int             mss;
2379         conn_t          *connp = (conn_t *)arg;
2380         squeue_t        *sqp = (squeue_t *)arg2;
2381         tcp_t           *tcp = connp->conn_tcp;
2382         tcp_stack_t     *tcps = tcp->tcp_tcps;
2383         sock_upcalls_t  *sockupcalls;
2384 
2385         /*
2386          * RST from fused tcp loopback peer should trigger an unfuse.
2387          */
2388         if (tcp->tcp_fused) {
2389                 TCP_STAT(tcps, tcp_fusion_aborted);
2390                 tcp_unfuse(tcp);
2391         }
2392 
2393         iphdr = mp->b_rptr;
2394         rptr = mp->b_rptr;
2395         ASSERT(OK_32PTR(rptr));
2396 
2397         ip_hdr_len = ira->ira_ip_hdr_length;
2398         if (connp->conn_recv_ancillary.crb_all != 0) {
2399                 /*
2400                  * Record packet information in the ip_pkt_t
2401                  */
2402                 ipp.ipp_fields = 0;
2403                 if (ira->ira_flags & IRAF_IS_IPV4) {
2404                         (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2405                             B_FALSE);
2406                 } else {
2407                         uint8_t nexthdrp;
2408 
2409                         /*
2410                          * IPv6 packets can only be received by applications
2411                          * that are prepared to receive IPv6 addresses.
2412                          * The IP fanout must ensure this.
2413                          */
2414                         ASSERT(connp->conn_family == AF_INET6);
2415 
2416                         (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2417                             &nexthdrp);
2418                         ASSERT(nexthdrp == IPPROTO_TCP);
2419 
2420                         /* Could have caused a pullup? */
2421                         iphdr = mp->b_rptr;
2422                         rptr = mp->b_rptr;
2423                 }
2424         }
2425         ASSERT(DB_TYPE(mp) == M_DATA);
2426         ASSERT(mp->b_next == NULL);
2427 
2428         tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2429         seg_seq = ntohl(tcpha->tha_seq);
2430         seg_ack = ntohl(tcpha->tha_ack);
2431         ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2432         seg_len = (int)(mp->b_wptr - rptr) -
2433             (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2434         if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2435                 do {
2436                         ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2437                             (uintptr_t)INT_MAX);
2438                         seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2439                 } while ((mp1 = mp1->b_cont) != NULL &&
2440                     mp1->b_datap->db_type == M_DATA);
2441         }
2442 
2443         DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2444             __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2445             __dtrace_tcp_tcph_t *, tcpha);
2446 
2447         if (tcp->tcp_state == TCPS_TIME_WAIT) {
2448                 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2449                     seg_len, tcpha, ira);
2450                 return;
2451         }
2452 
2453         if (sqp != NULL) {
2454                 /*
2455                  * This is the correct place to update tcp_last_recv_time. Note
2456                  * that it is also updated for tcp structure that belongs to
2457                  * global and listener queues which do not really need updating.
2458                  * But that should not cause any harm.  And it is updated for
2459                  * all kinds of incoming segments, not only for data segments.
2460                  */
2461                 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2462         }
2463 
2464         flags = (unsigned int)tcpha->tha_flags & 0xFF;
2465 
2466         BUMP_LOCAL(tcp->tcp_ibsegs);
2467         DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2468 
2469         if ((flags & TH_URG) && sqp != NULL) {
2470                 /*
2471                  * TCP can't handle urgent pointers that arrive before
2472                  * the connection has been accept()ed since it can't
2473                  * buffer OOB data.  Discard segment if this happens.
2474                  *
2475                  * We can't just rely on a non-null tcp_listener to indicate
2476                  * that the accept() has completed since unlinking of the
2477                  * eager and completion of the accept are not atomic.
2478                  * tcp_detached, when it is not set (B_FALSE) indicates
2479                  * that the accept() has completed.
2480                  *
2481                  * Nor can it reassemble urgent pointers, so discard
2482                  * if it's not the next segment expected.
2483                  *
2484                  * Otherwise, collapse chain into one mblk (discard if
2485                  * that fails).  This makes sure the headers, retransmitted
2486                  * data, and new data all are in the same mblk.
2487                  */
2488                 ASSERT(mp != NULL);
2489                 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2490                         freemsg(mp);
2491                         return;
2492                 }
2493                 /* Update pointers into message */
2494                 iphdr = rptr = mp->b_rptr;
2495                 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2496                 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2497                         /*
2498                          * Since we can't handle any data with this urgent
2499                          * pointer that is out of sequence, we expunge
2500                          * the data.  This allows us to still register
2501                          * the urgent mark and generate the M_PCSIG,
2502                          * which we can do.
2503                          */
2504                         mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2505                         seg_len = 0;
2506                 }
2507         }
2508 
2509         sockupcalls = connp->conn_upcalls;
2510         /* A conn_t may have belonged to a now-closed socket.  Be careful. */
2511         if (sockupcalls == NULL)
2512                 sockupcalls = &tcp_dummy_upcalls;
2513 
2514         switch (tcp->tcp_state) {
2515         case TCPS_SYN_SENT:
2516                 if (connp->conn_final_sqp == NULL &&
2517                     tcp_outbound_squeue_switch && sqp != NULL) {
2518                         ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2519                         connp->conn_final_sqp = sqp;
2520                         if (connp->conn_final_sqp != connp->conn_sqp) {
2521                                 DTRACE_PROBE1(conn__final__sqp__switch,
2522                                     conn_t *, connp);
2523                                 CONN_INC_REF(connp);
2524                                 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2525                                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2526                                     tcp_input_data, connp, ira, ip_squeue_flag,
2527                                     SQTAG_CONNECT_FINISH);
2528                                 return;
2529                         }
2530                         DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2531                 }
2532                 if (flags & TH_ACK) {
2533                         /*
2534                          * Note that our stack cannot send data before a
2535                          * connection is established, therefore the
2536                          * following check is valid.  Otherwise, it has
2537                          * to be changed.
2538                          */
2539                         if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2540                             SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2541                                 freemsg(mp);
2542                                 if (flags & TH_RST)
2543                                         return;
2544                                 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2545                                     tcp, seg_ack, 0, TH_RST);
2546                                 return;
2547                         }
2548                         ASSERT(tcp->tcp_suna + 1 == seg_ack);
2549                 }
2550                 if (flags & TH_RST) {
2551                         if (flags & TH_ACK) {
2552                                 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2553                                     ip_xmit_attr_t *, connp->conn_ixa,
2554                                     void_ip_t *, iphdr, tcp_t *, tcp,
2555                                     tcph_t *, tcpha);
2556                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
2557                         }
2558                         freemsg(mp);
2559                         return;
2560                 }
2561                 if (!(flags & TH_SYN)) {
2562                         freemsg(mp);
2563                         return;
2564                 }
2565 
2566                 /* Process all TCP options. */
2567                 tcp_process_options(tcp, tcpha);
2568                 /*
2569                  * The following changes our rwnd to be a multiple of the
2570                  * MIN(peer MSS, our MSS) for performance reason.
2571                  */
2572                 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2573                     tcp->tcp_mss));
2574 
2575                 /* Is the other end ECN capable? */
2576                 if (tcp->tcp_ecn_ok) {
2577                         if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2578                                 tcp->tcp_ecn_ok = B_FALSE;
2579                         }
2580                 }
2581                 /*
2582                  * Clear ECN flags because it may interfere with later
2583                  * processing.
2584                  */
2585                 flags &= ~(TH_ECE|TH_CWR);
2586 
2587                 tcp->tcp_irs = seg_seq;
2588                 tcp->tcp_rack = seg_seq;
2589                 tcp->tcp_rnxt = seg_seq + 1;
2590                 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2591                 if (!TCP_IS_DETACHED(tcp)) {
2592                         /* Allocate room for SACK options if needed. */
2593                         connp->conn_wroff = connp->conn_ht_iphc_len;
2594                         if (tcp->tcp_snd_sack_ok)
2595                                 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2596                         if (!tcp->tcp_loopback)
2597                                 connp->conn_wroff += tcps->tcps_wroff_xtra;
2598 
2599                         (void) proto_set_tx_wroff(connp->conn_rq, connp,
2600                             connp->conn_wroff);
2601                 }
2602                 if (flags & TH_ACK) {
2603                         /*
2604                          * If we can't get the confirmation upstream, pretend
2605                          * we didn't even see this one.
2606                          *
2607                          * XXX: how can we pretend we didn't see it if we
2608                          * have updated rnxt et. al.
2609                          *
2610                          * For loopback we defer sending up the T_CONN_CON
2611                          * until after some checks below.
2612                          */
2613                         mp1 = NULL;
2614                         /*
2615                          * tcp_sendmsg() checks tcp_state without entering
2616                          * the squeue so tcp_state should be updated before
2617                          * sending up connection confirmation.  Probe the
2618                          * state change below when we are sure the connection
2619                          * confirmation has been sent.
2620                          */
2621                         tcp->tcp_state = TCPS_ESTABLISHED;
2622                         if (!tcp_conn_con(tcp, iphdr, mp,
2623                             tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2624                                 tcp->tcp_state = TCPS_SYN_SENT;
2625                                 freemsg(mp);
2626                                 return;
2627                         }
2628                         TCPS_CONN_INC(tcps);
2629                         /* SYN was acked - making progress */
2630                         tcp->tcp_ip_forward_progress = B_TRUE;
2631 
2632                         /* One for the SYN */
2633                         tcp->tcp_suna = tcp->tcp_iss + 1;
2634                         tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2635 
2636                         /*
2637                          * If SYN was retransmitted, need to reset all
2638                          * retransmission info.  This is because this
2639                          * segment will be treated as a dup ACK.
2640                          */
2641                         if (tcp->tcp_rexmit) {
2642                                 tcp->tcp_rexmit = B_FALSE;
2643                                 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2644                                 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2645                                 tcp->tcp_snd_burst = tcp->tcp_localnet ?
2646                                     TCP_CWND_INFINITE : TCP_CWND_NORMAL;
2647                                 tcp->tcp_ms_we_have_waited = 0;
2648 
2649                                 /*
2650                                  * Set tcp_cwnd back to 1 MSS, per
2651                                  * recommendation from
2652                                  * draft-floyd-incr-init-win-01.txt,
2653                                  * Increasing TCP's Initial Window.
2654                                  */
2655                                 tcp->tcp_cwnd = tcp->tcp_mss;
2656                         }
2657 
2658                         tcp->tcp_swl1 = seg_seq;
2659                         tcp->tcp_swl2 = seg_ack;
2660 
2661                         new_swnd = ntohs(tcpha->tha_win);
2662                         tcp->tcp_swnd = new_swnd;
2663                         if (new_swnd > tcp->tcp_max_swnd)
2664                                 tcp->tcp_max_swnd = new_swnd;
2665 
2666                         /*
2667                          * Always send the three-way handshake ack immediately
2668                          * in order to make the connection complete as soon as
2669                          * possible on the accepting host.
2670                          */
2671                         flags |= TH_ACK_NEEDED;
2672 
2673                         /*
2674                          * Trace connect-established here.
2675                          */
2676                         DTRACE_TCP5(connect__established, mblk_t *, NULL,
2677                             ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2678                             void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2679 
2680                         /* Trace change from SYN_SENT -> ESTABLISHED here */
2681                         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2682                             connp->conn_ixa, void, NULL, tcp_t *, tcp,
2683                             void, NULL, int32_t, TCPS_SYN_SENT);
2684 
2685                         /*
2686                          * Special case for loopback.  At this point we have
2687                          * received SYN-ACK from the remote endpoint.  In
2688                          * order to ensure that both endpoints reach the
2689                          * fused state prior to any data exchange, the final
2690                          * ACK needs to be sent before we indicate T_CONN_CON
2691                          * to the module upstream.
2692                          */
2693                         if (tcp->tcp_loopback) {
2694                                 mblk_t *ack_mp;
2695 
2696                                 ASSERT(!tcp->tcp_unfusable);
2697                                 ASSERT(mp1 != NULL);
2698                                 /*
2699                                  * For loopback, we always get a pure SYN-ACK
2700                                  * and only need to send back the final ACK
2701                                  * with no data (this is because the other
2702                                  * tcp is ours and we don't do T/TCP).  This
2703                                  * final ACK triggers the passive side to
2704                                  * perform fusion in ESTABLISHED state.
2705                                  */
2706                                 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2707                                         if (tcp->tcp_ack_tid != 0) {
2708                                                 (void) TCP_TIMER_CANCEL(tcp,
2709                                                     tcp->tcp_ack_tid);
2710                                                 tcp->tcp_ack_tid = 0;
2711                                         }
2712                                         tcp_send_data(tcp, ack_mp);
2713                                         BUMP_LOCAL(tcp->tcp_obsegs);
2714                                         TCPS_BUMP_MIB(tcps, tcpOutAck);
2715 
2716                                         if (!IPCL_IS_NONSTR(connp)) {
2717                                                 /* Send up T_CONN_CON */
2718                                                 if (ira->ira_cred != NULL) {
2719                                                         mblk_setcred(mp1,
2720                                                             ira->ira_cred,
2721                                                             ira->ira_cpid);
2722                                                 }
2723                                                 putnext(connp->conn_rq, mp1);
2724                                         } else {
2725                                                 (*sockupcalls->su_connected)
2726                                                     (connp->conn_upper_handle,
2727                                                     tcp->tcp_connid,
2728                                                     ira->ira_cred,
2729                                                     ira->ira_cpid);
2730                                                 freemsg(mp1);
2731                                         }
2732 
2733                                         freemsg(mp);
2734                                         return;
2735                                 }
2736                                 /*
2737                                  * Forget fusion; we need to handle more
2738                                  * complex cases below.  Send the deferred
2739                                  * T_CONN_CON message upstream and proceed
2740                                  * as usual.  Mark this tcp as not capable
2741                                  * of fusion.
2742                                  */
2743                                 TCP_STAT(tcps, tcp_fusion_unfusable);
2744                                 tcp->tcp_unfusable = B_TRUE;
2745                                 if (!IPCL_IS_NONSTR(connp)) {
2746                                         if (ira->ira_cred != NULL) {
2747                                                 mblk_setcred(mp1, ira->ira_cred,
2748                                                     ira->ira_cpid);
2749                                         }
2750                                         putnext(connp->conn_rq, mp1);
2751                                 } else {
2752                                         (*sockupcalls->su_connected)
2753                                             (connp->conn_upper_handle,
2754                                             tcp->tcp_connid, ira->ira_cred,
2755                                             ira->ira_cpid);
2756                                         freemsg(mp1);
2757                                 }
2758                         }
2759 
2760                         /*
2761                          * Check to see if there is data to be sent.  If
2762                          * yes, set the transmit flag.  Then check to see
2763                          * if received data processing needs to be done.
2764                          * If not, go straight to xmit_check.  This short
2765                          * cut is OK as we don't support T/TCP.
2766                          */
2767                         if (tcp->tcp_unsent)
2768                                 flags |= TH_XMIT_NEEDED;
2769 
2770                         if (seg_len == 0 && !(flags & TH_URG)) {
2771                                 freemsg(mp);
2772                                 goto xmit_check;
2773                         }
2774 
2775                         flags &= ~TH_SYN;
2776                         seg_seq++;
2777                         break;
2778                 }
2779                 tcp->tcp_state = TCPS_SYN_RCVD;
2780                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2781                     connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2782                     tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2783                 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2784                     NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2785                 if (mp1 != NULL) {
2786                         tcp_send_data(tcp, mp1);
2787                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2788                 }
2789                 freemsg(mp);
2790                 return;
2791         case TCPS_SYN_RCVD:
2792                 if (flags & TH_ACK) {
2793                         uint32_t pinit_wnd;
2794 
2795                         /*
2796                          * In this state, a SYN|ACK packet is either bogus
2797                          * because the other side must be ACKing our SYN which
2798                          * indicates it has seen the ACK for their SYN and
2799                          * shouldn't retransmit it or we're crossing SYNs
2800                          * on active open.
2801                          */
2802                         if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2803                                 freemsg(mp);
2804                                 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2805                                     tcp, seg_ack, 0, TH_RST);
2806                                 return;
2807                         }
2808                         /*
2809                          * NOTE: RFC 793 pg. 72 says this should be
2810                          * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2811                          * but that would mean we have an ack that ignored
2812                          * our SYN.
2813                          */
2814                         if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2815                             SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2816                                 freemsg(mp);
2817                                 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2818                                     tcp, seg_ack, 0, TH_RST);
2819                                 return;
2820                         }
2821                         /*
2822                          * No sane TCP stack will send such a small window
2823                          * without receiving any data.  Just drop this invalid
2824                          * ACK.  We also shorten the abort timeout in case
2825                          * this is an attack.
2826                          */
2827                         pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2828                         if (pinit_wnd < tcp->tcp_mss &&
2829                             pinit_wnd < tcp_init_wnd_chk) {
2830                                 freemsg(mp);
2831                                 TCP_STAT(tcps, tcp_zwin_ack_syn);
2832                                 tcp->tcp_second_ctimer_threshold =
2833                                     tcp_early_abort * SECONDS;
2834                                 return;
2835                         }
2836                 }
2837                 break;
2838         case TCPS_LISTEN:
2839                 /*
2840                  * Only a TLI listener can come through this path when a
2841                  * acceptor is going back to be a listener and a packet
2842                  * for the acceptor hits the classifier. For a socket
2843                  * listener, this can never happen because a listener
2844                  * can never accept connection on itself and hence a
2845                  * socket acceptor can not go back to being a listener.
2846                  */
2847                 ASSERT(!TCP_IS_SOCKET(tcp));
2848                 /*FALLTHRU*/
2849         case TCPS_CLOSED:
2850         case TCPS_BOUND: {
2851                 conn_t  *new_connp;
2852                 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2853 
2854                 /*
2855                  * Don't accept any input on a closed tcp as this TCP logically
2856                  * does not exist on the system. Don't proceed further with
2857                  * this TCP. For instance, this packet could trigger another
2858                  * close of this tcp which would be disastrous for tcp_refcnt.
2859                  * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2860                  * be called at most once on a TCP. In this case we need to
2861                  * refeed the packet into the classifier and figure out where
2862                  * the packet should go.
2863                  */
2864                 new_connp = ipcl_classify(mp, ira, ipst);
2865                 if (new_connp != NULL) {
2866                         /* Drops ref on new_connp */
2867                         tcp_reinput(new_connp, mp, ira, ipst);
2868                         return;
2869                 }
2870                 /* We failed to classify. For now just drop the packet */
2871                 freemsg(mp);
2872                 return;
2873         }
2874         case TCPS_IDLE:
2875                 /*
2876                  * Handle the case where the tcp_clean_death() has happened
2877                  * on a connection (application hasn't closed yet) but a packet
2878                  * was already queued on squeue before tcp_clean_death()
2879                  * was processed. Calling tcp_clean_death() twice on same
2880                  * connection can result in weird behaviour.
2881                  */
2882                 freemsg(mp);
2883                 return;
2884         default:
2885                 break;
2886         }
2887 
2888         /*
2889          * Already on the correct queue/perimeter.
2890          * If this is a detached connection and not an eager
2891          * connection hanging off a listener then new data
2892          * (past the FIN) will cause a reset.
2893          * We do a special check here where it
2894          * is out of the main line, rather than check
2895          * if we are detached every time we see new
2896          * data down below.
2897          */
2898         if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2899             (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2900                 TCPS_BUMP_MIB(tcps, tcpInClosed);
2901                 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2902                 freemsg(mp);
2903                 tcp_xmit_ctl("new data when detached", tcp,
2904                     tcp->tcp_snxt, 0, TH_RST);
2905                 (void) tcp_clean_death(tcp, EPROTO);
2906                 return;
2907         }
2908 
2909         mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2910         urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2911         new_swnd = ntohs(tcpha->tha_win) <<
2912             ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2913 
2914         if (tcp->tcp_snd_ts_ok) {
2915                 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
2916                         /*
2917                          * This segment is not acceptable.
2918                          * Drop it and send back an ACK.
2919                          */
2920                         freemsg(mp);
2921                         flags |= TH_ACK_NEEDED;
2922                         goto ack_check;
2923                 }
2924         } else if (tcp->tcp_snd_sack_ok) {
2925                 tcpopt.tcp = tcp;
2926                 /*
2927                  * SACK info in already updated in tcp_parse_options.  Ignore
2928                  * all other TCP options...
2929                  */
2930                 (void) tcp_parse_options(tcpha, &tcpopt);
2931         }
2932 try_again:;
2933         mss = tcp->tcp_mss;
2934         gap = seg_seq - tcp->tcp_rnxt;
2935         rgap = tcp->tcp_rwnd - (gap + seg_len);
2936         /*
2937          * gap is the amount of sequence space between what we expect to see
2938          * and what we got for seg_seq.  A positive value for gap means
2939          * something got lost.  A negative value means we got some old stuff.
2940          */
2941         if (gap < 0) {
2942                 /* Old stuff present.  Is the SYN in there? */
2943                 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2944                     (seg_len != 0)) {
2945                         flags &= ~TH_SYN;
2946                         seg_seq++;
2947                         urp--;
2948                         /* Recompute the gaps after noting the SYN. */
2949                         goto try_again;
2950                 }
2951                 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2952                 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2953                     (seg_len > -gap ? -gap : seg_len));
2954                 /* Remove the old stuff from seg_len. */
2955                 seg_len += gap;
2956                 /*
2957                  * Anything left?
2958                  * Make sure to check for unack'd FIN when rest of data
2959                  * has been previously ack'd.
2960                  */
2961                 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2962                         /*
2963                          * Resets are only valid if they lie within our offered
2964                          * window.  If the RST bit is set, we just ignore this
2965                          * segment.
2966                          */
2967                         if (flags & TH_RST) {
2968                                 freemsg(mp);
2969                                 return;
2970                         }
2971 
2972                         /*
2973                          * The arriving of dup data packets indicate that we
2974                          * may have postponed an ack for too long, or the other
2975                          * side's RTT estimate is out of shape. Start acking
2976                          * more often.
2977                          */
2978                         if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2979                             tcp->tcp_rack_cnt >= 1 &&
2980                             tcp->tcp_rack_abs_max > 2) {
2981                                 tcp->tcp_rack_abs_max--;
2982                         }
2983                         tcp->tcp_rack_cur_max = 1;
2984 
2985                         /*
2986                          * This segment is "unacceptable".  None of its
2987                          * sequence space lies within our advertized window.
2988                          *
2989                          * Adjust seg_len to the original value for tracing.
2990                          */
2991                         seg_len -= gap;
2992                         if (connp->conn_debug) {
2993                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2994                                     "tcp_rput: unacceptable, gap %d, rgap %d, "
2995                                     "flags 0x%x, seg_seq %u, seg_ack %u, "
2996                                     "seg_len %d, rnxt %u, snxt %u, %s",
2997                                     gap, rgap, flags, seg_seq, seg_ack,
2998                                     seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
2999                                     tcp_display(tcp, NULL,
3000                                     DISP_ADDR_AND_PORT));
3001                         }
3002 
3003                         /*
3004                          * Arrange to send an ACK in response to the
3005                          * unacceptable segment per RFC 793 page 69. There
3006                          * is only one small difference between ours and the
3007                          * acceptability test in the RFC - we accept ACK-only
3008                          * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3009                          * will be generated.
3010                          *
3011                          * Note that we have to ACK an ACK-only packet at least
3012                          * for stacks that send 0-length keep-alives with
3013                          * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3014                          * section 4.2.3.6. As long as we don't ever generate
3015                          * an unacceptable packet in response to an incoming
3016                          * packet that is unacceptable, it should not cause
3017                          * "ACK wars".
3018                          */
3019                         flags |=  TH_ACK_NEEDED;
3020 
3021                         /*
3022                          * Continue processing this segment in order to use the
3023                          * ACK information it contains, but skip all other
3024                          * sequence-number processing.  Processing the ACK
3025                          * information is necessary in order to
3026                          * re-synchronize connections that may have lost
3027                          * synchronization.
3028                          *
3029                          * We clear seg_len and flag fields related to
3030                          * sequence number processing as they are not
3031                          * to be trusted for an unacceptable segment.
3032                          */
3033                         seg_len = 0;
3034                         flags &= ~(TH_SYN | TH_FIN | TH_URG);
3035                         goto process_ack;
3036                 }
3037 
3038                 /* Fix seg_seq, and chew the gap off the front. */
3039                 seg_seq = tcp->tcp_rnxt;
3040                 urp += gap;
3041                 do {
3042                         mblk_t  *mp2;
3043                         ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3044                             (uintptr_t)UINT_MAX);
3045                         gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3046                         if (gap > 0) {
3047                                 mp->b_rptr = mp->b_wptr - gap;
3048                                 break;
3049                         }
3050                         mp2 = mp;
3051                         mp = mp->b_cont;
3052                         freeb(mp2);
3053                 } while (gap < 0);
3054                 /*
3055                  * If the urgent data has already been acknowledged, we
3056                  * should ignore TH_URG below
3057                  */
3058                 if (urp < 0)
3059                         flags &= ~TH_URG;
3060         }
3061         /*
3062          * rgap is the amount of stuff received out of window.  A negative
3063          * value is the amount out of window.
3064          */
3065         if (rgap < 0) {
3066                 mblk_t  *mp2;
3067 
3068                 if (tcp->tcp_rwnd == 0) {
3069                         TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3070                 } else {
3071                         TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3072                         TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3073                 }
3074 
3075                 /*
3076                  * seg_len does not include the FIN, so if more than
3077                  * just the FIN is out of window, we act like we don't
3078                  * see it.  (If just the FIN is out of window, rgap
3079                  * will be zero and we will go ahead and acknowledge
3080                  * the FIN.)
3081                  */
3082                 flags &= ~TH_FIN;
3083 
3084                 /* Fix seg_len and make sure there is something left. */
3085                 seg_len += rgap;
3086                 if (seg_len <= 0) {
3087                         /*
3088                          * Resets are only valid if they lie within our offered
3089                          * window.  If the RST bit is set, we just ignore this
3090                          * segment.
3091                          */
3092                         if (flags & TH_RST) {
3093                                 freemsg(mp);
3094                                 return;
3095                         }
3096 
3097                         /* Per RFC 793, we need to send back an ACK. */
3098                         flags |= TH_ACK_NEEDED;
3099 
3100                         /*
3101                          * Send SIGURG as soon as possible i.e. even
3102                          * if the TH_URG was delivered in a window probe
3103                          * packet (which will be unacceptable).
3104                          *
3105                          * We generate a signal if none has been generated
3106                          * for this connection or if this is a new urgent
3107                          * byte. Also send a zero-length "unmarked" message
3108                          * to inform SIOCATMARK that this is not the mark.
3109                          *
3110                          * tcp_urp_last_valid is cleared when the T_exdata_ind
3111                          * is sent up. This plus the check for old data
3112                          * (gap >= 0) handles the wraparound of the sequence
3113                          * number space without having to always track the
3114                          * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3115                          * this max in its rcv_up variable).
3116                          *
3117                          * This prevents duplicate SIGURGS due to a "late"
3118                          * zero-window probe when the T_EXDATA_IND has already
3119                          * been sent up.
3120                          */
3121                         if ((flags & TH_URG) &&
3122                             (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3123                             tcp->tcp_urp_last))) {
3124                                 if (IPCL_IS_NONSTR(connp)) {
3125                                         if (!TCP_IS_DETACHED(tcp)) {
3126                                                 (*sockupcalls->su_signal_oob)
3127                                                     (connp->conn_upper_handle,
3128                                                     urp);
3129                                         }
3130                                 } else {
3131                                         mp1 = allocb(0, BPRI_MED);
3132                                         if (mp1 == NULL) {
3133                                                 freemsg(mp);
3134                                                 return;
3135                                         }
3136                                         if (!TCP_IS_DETACHED(tcp) &&
3137                                             !putnextctl1(connp->conn_rq,
3138                                             M_PCSIG, SIGURG)) {
3139                                                 /* Try again on the rexmit. */
3140                                                 freemsg(mp1);
3141                                                 freemsg(mp);
3142                                                 return;
3143                                         }
3144                                         /*
3145                                          * If the next byte would be the mark
3146                                          * then mark with MARKNEXT else mark
3147                                          * with NOTMARKNEXT.
3148                                          */
3149                                         if (gap == 0 && urp == 0)
3150                                                 mp1->b_flag |= MSGMARKNEXT;
3151                                         else
3152                                                 mp1->b_flag |= MSGNOTMARKNEXT;
3153                                         freemsg(tcp->tcp_urp_mark_mp);
3154                                         tcp->tcp_urp_mark_mp = mp1;
3155                                         flags |= TH_SEND_URP_MARK;
3156                                 }
3157                                 tcp->tcp_urp_last_valid = B_TRUE;
3158                                 tcp->tcp_urp_last = urp + seg_seq;
3159                         }
3160                         /*
3161                          * If this is a zero window probe, continue to
3162                          * process the ACK part.  But we need to set seg_len
3163                          * to 0 to avoid data processing.  Otherwise just
3164                          * drop the segment and send back an ACK.
3165                          */
3166                         if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3167                                 flags &= ~(TH_SYN | TH_URG);
3168                                 seg_len = 0;
3169                                 goto process_ack;
3170                         } else {
3171                                 freemsg(mp);
3172                                 goto ack_check;
3173                         }
3174                 }
3175                 /* Pitch out of window stuff off the end. */
3176                 rgap = seg_len;
3177                 mp2 = mp;
3178                 do {
3179                         ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3180                             (uintptr_t)INT_MAX);
3181                         rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3182                         if (rgap < 0) {
3183                                 mp2->b_wptr += rgap;
3184                                 if ((mp1 = mp2->b_cont) != NULL) {
3185                                         mp2->b_cont = NULL;
3186                                         freemsg(mp1);
3187                                 }
3188                                 break;
3189                         }
3190                 } while ((mp2 = mp2->b_cont) != NULL);
3191         }
3192 ok:;
3193         /*
3194          * TCP should check ECN info for segments inside the window only.
3195          * Therefore the check should be done here.
3196          */
3197         if (tcp->tcp_ecn_ok) {
3198                 if (flags & TH_CWR) {
3199                         tcp->tcp_ecn_echo_on = B_FALSE;
3200                 }
3201                 /*
3202                  * Note that both ECN_CE and CWR can be set in the
3203                  * same segment.  In this case, we once again turn
3204                  * on ECN_ECHO.
3205                  */
3206                 if (connp->conn_ipversion == IPV4_VERSION) {
3207                         uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3208 
3209                         if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3210                                 tcp->tcp_ecn_echo_on = B_TRUE;
3211                         }
3212                 } else {
3213                         uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3214 
3215                         if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3216                             htonl(IPH_ECN_CE << 20)) {
3217                                 tcp->tcp_ecn_echo_on = B_TRUE;
3218                         }
3219                 }
3220         }
3221 
3222         /*
3223          * Check whether we can update tcp_ts_recent.  This test is
3224          * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
3225          * Extensions for High Performance: An Update", Internet Draft.
3226          */
3227         if (tcp->tcp_snd_ts_ok &&
3228             TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3229             SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3230                 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3231                 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3232         }
3233 
3234         if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3235                 /*
3236                  * FIN in an out of order segment.  We record this in
3237                  * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3238                  * Clear the FIN so that any check on FIN flag will fail.
3239                  * Remember that FIN also counts in the sequence number
3240                  * space.  So we need to ack out of order FIN only segments.
3241                  */
3242                 if (flags & TH_FIN) {
3243                         tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3244                         tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3245                         flags &= ~TH_FIN;
3246                         flags |= TH_ACK_NEEDED;
3247                 }
3248                 if (seg_len > 0) {
3249                         /* Fill in the SACK blk list. */
3250                         if (tcp->tcp_snd_sack_ok) {
3251                                 tcp_sack_insert(tcp->tcp_sack_list,
3252                                     seg_seq, seg_seq + seg_len,
3253                                     &(tcp->tcp_num_sack_blk));
3254                         }
3255 
3256                         /*
3257                          * Attempt reassembly and see if we have something
3258                          * ready to go.
3259                          */
3260                         mp = tcp_reass(tcp, mp, seg_seq);
3261                         /* Always ack out of order packets */
3262                         flags |= TH_ACK_NEEDED | TH_PUSH;
3263                         if (mp) {
3264                                 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3265                                     (uintptr_t)INT_MAX);
3266                                 seg_len = mp->b_cont ? msgdsize(mp) :
3267                                     (int)(mp->b_wptr - mp->b_rptr);
3268                                 seg_seq = tcp->tcp_rnxt;
3269                                 /*
3270                                  * A gap is filled and the seq num and len
3271                                  * of the gap match that of a previously
3272                                  * received FIN, put the FIN flag back in.
3273                                  */
3274                                 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3275                                     seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3276                                         flags |= TH_FIN;
3277                                         tcp->tcp_valid_bits &=
3278                                             ~TCP_OFO_FIN_VALID;
3279                                 }
3280                                 if (tcp->tcp_reass_tid != 0) {
3281                                         (void) TCP_TIMER_CANCEL(tcp,
3282                                             tcp->tcp_reass_tid);
3283                                         /*
3284                                          * Restart the timer if there is still
3285                                          * data in the reassembly queue.
3286                                          */
3287                                         if (tcp->tcp_reass_head != NULL) {
3288                                                 tcp->tcp_reass_tid = TCP_TIMER(
3289                                                     tcp, tcp_reass_timer,
3290                                                     tcps->tcps_reass_timeout);
3291                                         } else {
3292                                                 tcp->tcp_reass_tid = 0;
3293                                         }
3294                                 }
3295                         } else {
3296                                 /*
3297                                  * Keep going even with NULL mp.
3298                                  * There may be a useful ACK or something else
3299                                  * we don't want to miss.
3300                                  *
3301                                  * But TCP should not perform fast retransmit
3302                                  * because of the ack number.  TCP uses
3303                                  * seg_len == 0 to determine if it is a pure
3304                                  * ACK.  And this is not a pure ACK.
3305                                  */
3306                                 seg_len = 0;
3307                                 ofo_seg = B_TRUE;
3308 
3309                                 if (tcps->tcps_reass_timeout != 0 &&
3310                                     tcp->tcp_reass_tid == 0) {
3311                                         tcp->tcp_reass_tid = TCP_TIMER(tcp,
3312                                             tcp_reass_timer,
3313                                             tcps->tcps_reass_timeout);
3314                                 }
3315                         }
3316                 }
3317         } else if (seg_len > 0) {
3318                 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3319                 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3320                 /*
3321                  * If an out of order FIN was received before, and the seq
3322                  * num and len of the new segment match that of the FIN,
3323                  * put the FIN flag back in.
3324                  */
3325                 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3326                     seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3327                         flags |= TH_FIN;
3328                         tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3329                 }
3330         }
3331         if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3332         if (flags & TH_RST) {
3333                 freemsg(mp);
3334                 switch (tcp->tcp_state) {
3335                 case TCPS_SYN_RCVD:
3336                         (void) tcp_clean_death(tcp, ECONNREFUSED);
3337                         break;
3338                 case TCPS_ESTABLISHED:
3339                 case TCPS_FIN_WAIT_1:
3340                 case TCPS_FIN_WAIT_2:
3341                 case TCPS_CLOSE_WAIT:
3342                         (void) tcp_clean_death(tcp, ECONNRESET);
3343                         break;
3344                 case TCPS_CLOSING:
3345                 case TCPS_LAST_ACK:
3346                         (void) tcp_clean_death(tcp, 0);
3347                         break;
3348                 default:
3349                         ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3350                         (void) tcp_clean_death(tcp, ENXIO);
3351                         break;
3352                 }
3353                 return;
3354         }
3355         if (flags & TH_SYN) {
3356                 /*
3357                  * See RFC 793, Page 71
3358                  *
3359                  * The seq number must be in the window as it should
3360                  * be "fixed" above.  If it is outside window, it should
3361                  * be already rejected.  Note that we allow seg_seq to be
3362                  * rnxt + rwnd because we want to accept 0 window probe.
3363                  */
3364                 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3365                     SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3366                 freemsg(mp);
3367                 /*
3368                  * If the ACK flag is not set, just use our snxt as the
3369                  * seq number of the RST segment.
3370                  */
3371                 if (!(flags & TH_ACK)) {
3372                         seg_ack = tcp->tcp_snxt;
3373                 }
3374                 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3375                     TH_RST|TH_ACK);
3376                 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3377                 (void) tcp_clean_death(tcp, ECONNRESET);
3378                 return;
3379         }
3380         /*
3381          * urp could be -1 when the urp field in the packet is 0
3382          * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3383          * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3384          */
3385         if (flags & TH_URG && urp >= 0) {
3386                 if (!tcp->tcp_urp_last_valid ||
3387                     SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3388                         /*
3389                          * Non-STREAMS sockets handle the urgent data a litte
3390                          * differently from STREAMS based sockets. There is no
3391                          * need to mark any mblks with the MSG{NOT,}MARKNEXT
3392                          * flags to keep SIOCATMARK happy. Instead a
3393                          * su_signal_oob upcall is made to update the mark.
3394                          * Neither is a T_EXDATA_IND mblk needed to be
3395                          * prepended to the urgent data. The urgent data is
3396                          * delivered using the su_recv upcall, where we set
3397                          * the MSG_OOB flag to indicate that it is urg data.
3398                          *
3399                          * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3400                          * are used by non-STREAMS sockets.
3401                          */
3402                         if (IPCL_IS_NONSTR(connp)) {
3403                                 if (!TCP_IS_DETACHED(tcp)) {
3404                                         (*sockupcalls->su_signal_oob)
3405                                             (connp->conn_upper_handle, urp);
3406                                 }
3407                         } else {
3408                                 /*
3409                                  * If we haven't generated the signal yet for
3410                                  * this urgent pointer value, do it now.  Also,
3411                                  * send up a zero-length M_DATA indicating
3412                                  * whether or not this is the mark. The latter
3413                                  * is not needed when a T_EXDATA_IND is sent up.
3414                                  * However, if there are allocation failures
3415                                  * this code relies on the sender retransmitting
3416                                  * and the socket code for determining the mark
3417                                  * should not block waiting for the peer to
3418                                  * transmit. Thus, for simplicity we always
3419                                  * send up the mark indication.
3420                                  */
3421                                 mp1 = allocb(0, BPRI_MED);
3422                                 if (mp1 == NULL) {
3423                                         freemsg(mp);
3424                                         return;
3425                                 }
3426                                 if (!TCP_IS_DETACHED(tcp) &&
3427                                     !putnextctl1(connp->conn_rq, M_PCSIG,
3428                                     SIGURG)) {
3429                                         /* Try again on the rexmit. */
3430                                         freemsg(mp1);
3431                                         freemsg(mp);
3432                                         return;
3433                                 }
3434                                 /*
3435                                  * Mark with NOTMARKNEXT for now.
3436                                  * The code below will change this to MARKNEXT
3437                                  * if we are at the mark.
3438                                  *
3439                                  * If there are allocation failures (e.g. in
3440                                  * dupmsg below) the next time tcp_input_data
3441                                  * sees the urgent segment it will send up the
3442                                  * MSGMARKNEXT message.
3443                                  */
3444                                 mp1->b_flag |= MSGNOTMARKNEXT;
3445                                 freemsg(tcp->tcp_urp_mark_mp);
3446                                 tcp->tcp_urp_mark_mp = mp1;
3447                                 flags |= TH_SEND_URP_MARK;
3448 #ifdef DEBUG
3449                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3450                                     "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3451                                     "last %x, %s",
3452                                     seg_seq, urp, tcp->tcp_urp_last,
3453                                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
3454 #endif /* DEBUG */
3455                         }
3456                         tcp->tcp_urp_last_valid = B_TRUE;
3457                         tcp->tcp_urp_last = urp + seg_seq;
3458                 } else if (tcp->tcp_urp_mark_mp != NULL) {
3459                         /*
3460                          * An allocation failure prevented the previous
3461                          * tcp_input_data from sending up the allocated
3462                          * MSG*MARKNEXT message - send it up this time
3463                          * around.
3464                          */
3465                         flags |= TH_SEND_URP_MARK;
3466                 }
3467 
3468                 /*
3469                  * If the urgent byte is in this segment, make sure that it is
3470                  * all by itself.  This makes it much easier to deal with the
3471                  * possibility of an allocation failure on the T_exdata_ind.
3472                  * Note that seg_len is the number of bytes in the segment, and
3473                  * urp is the offset into the segment of the urgent byte.
3474                  * urp < seg_len means that the urgent byte is in this segment.
3475                  */
3476                 if (urp < seg_len) {
3477                         if (seg_len != 1) {
3478                                 uint32_t  tmp_rnxt;
3479                                 /*
3480                                  * Break it up and feed it back in.
3481                                  * Re-attach the IP header.
3482                                  */
3483                                 mp->b_rptr = iphdr;
3484                                 if (urp > 0) {
3485                                         /*
3486                                          * There is stuff before the urgent
3487                                          * byte.
3488                                          */
3489                                         mp1 = dupmsg(mp);
3490                                         if (!mp1) {
3491                                                 /*
3492                                                  * Trim from urgent byte on.
3493                                                  * The rest will come back.
3494                                                  */
3495                                                 (void) adjmsg(mp,
3496                                                     urp - seg_len);
3497                                                 tcp_input_data(connp,
3498                                                     mp, NULL, ira);
3499                                                 return;
3500                                         }
3501                                         (void) adjmsg(mp1, urp - seg_len);
3502                                         /* Feed this piece back in. */
3503                                         tmp_rnxt = tcp->tcp_rnxt;
3504                                         tcp_input_data(connp, mp1, NULL, ira);
3505                                         /*
3506                                          * If the data passed back in was not
3507                                          * processed (ie: bad ACK) sending
3508                                          * the remainder back in will cause a
3509                                          * loop. In this case, drop the
3510                                          * packet and let the sender try
3511                                          * sending a good packet.
3512                                          */
3513                                         if (tmp_rnxt == tcp->tcp_rnxt) {
3514                                                 freemsg(mp);
3515                                                 return;
3516                                         }
3517                                 }
3518                                 if (urp != seg_len - 1) {
3519                                         uint32_t  tmp_rnxt;
3520                                         /*
3521                                          * There is stuff after the urgent
3522                                          * byte.
3523                                          */
3524                                         mp1 = dupmsg(mp);
3525                                         if (!mp1) {
3526                                                 /*
3527                                                  * Trim everything beyond the
3528                                                  * urgent byte.  The rest will
3529                                                  * come back.
3530                                                  */
3531                                                 (void) adjmsg(mp,
3532                                                     urp + 1 - seg_len);
3533                                                 tcp_input_data(connp,
3534                                                     mp, NULL, ira);
3535                                                 return;
3536                                         }
3537                                         (void) adjmsg(mp1, urp + 1 - seg_len);
3538                                         tmp_rnxt = tcp->tcp_rnxt;
3539                                         tcp_input_data(connp, mp1, NULL, ira);
3540                                         /*
3541                                          * If the data passed back in was not
3542                                          * processed (ie: bad ACK) sending
3543                                          * the remainder back in will cause a
3544                                          * loop. In this case, drop the
3545                                          * packet and let the sender try
3546                                          * sending a good packet.
3547                                          */
3548                                         if (tmp_rnxt == tcp->tcp_rnxt) {
3549                                                 freemsg(mp);
3550                                                 return;
3551                                         }
3552                                 }
3553                                 tcp_input_data(connp, mp, NULL, ira);
3554                                 return;
3555                         }
3556                         /*
3557                          * This segment contains only the urgent byte.  We
3558                          * have to allocate the T_exdata_ind, if we can.
3559                          */
3560                         if (IPCL_IS_NONSTR(connp)) {
3561                                 int error;
3562 
3563                                 (*sockupcalls->su_recv)
3564                                     (connp->conn_upper_handle, mp, seg_len,
3565                                     MSG_OOB, &error, NULL);
3566                                 /*
3567                                  * We should never be in middle of a
3568                                  * fallback, the squeue guarantees that.
3569                                  */
3570                                 ASSERT(error != EOPNOTSUPP);
3571                                 mp = NULL;
3572                                 goto update_ack;
3573                         } else if (!tcp->tcp_urp_mp) {
3574                                 struct T_exdata_ind *tei;
3575                                 mp1 = allocb(sizeof (struct T_exdata_ind),
3576                                     BPRI_MED);
3577                                 if (!mp1) {
3578                                         /*
3579                                          * Sigh... It'll be back.
3580                                          * Generate any MSG*MARK message now.
3581                                          */
3582                                         freemsg(mp);
3583                                         seg_len = 0;
3584                                         if (flags & TH_SEND_URP_MARK) {
3585 
3586 
3587                                                 ASSERT(tcp->tcp_urp_mark_mp);
3588                                                 tcp->tcp_urp_mark_mp->b_flag &=
3589                                                     ~MSGNOTMARKNEXT;
3590                                                 tcp->tcp_urp_mark_mp->b_flag |=
3591                                                     MSGMARKNEXT;
3592                                         }
3593                                         goto ack_check;
3594                                 }
3595                                 mp1->b_datap->db_type = M_PROTO;
3596                                 tei = (struct T_exdata_ind *)mp1->b_rptr;
3597                                 tei->PRIM_type = T_EXDATA_IND;
3598                                 tei->MORE_flag = 0;
3599                                 mp1->b_wptr = (uchar_t *)&tei[1];
3600                                 tcp->tcp_urp_mp = mp1;
3601 #ifdef DEBUG
3602                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3603                                     "tcp_rput: allocated exdata_ind %s",
3604                                     tcp_display(tcp, NULL,
3605                                     DISP_PORT_ONLY));
3606 #endif /* DEBUG */
3607                                 /*
3608                                  * There is no need to send a separate MSG*MARK
3609                                  * message since the T_EXDATA_IND will be sent
3610                                  * now.
3611                                  */
3612                                 flags &= ~TH_SEND_URP_MARK;
3613                                 freemsg(tcp->tcp_urp_mark_mp);
3614                                 tcp->tcp_urp_mark_mp = NULL;
3615                         }
3616                         /*
3617                          * Now we are all set.  On the next putnext upstream,
3618                          * tcp_urp_mp will be non-NULL and will get prepended
3619                          * to what has to be this piece containing the urgent
3620                          * byte.  If for any reason we abort this segment below,
3621                          * if it comes back, we will have this ready, or it
3622                          * will get blown off in close.
3623                          */
3624                 } else if (urp == seg_len) {
3625                         /*
3626                          * The urgent byte is the next byte after this sequence
3627                          * number. If this endpoint is non-STREAMS, then there
3628                          * is nothing to do here since the socket has already
3629                          * been notified about the urg pointer by the
3630                          * su_signal_oob call above.
3631                          *
3632                          * In case of STREAMS, some more work might be needed.
3633                          * If there is data it is marked with MSGMARKNEXT and
3634                          * and any tcp_urp_mark_mp is discarded since it is not
3635                          * needed. Otherwise, if the code above just allocated
3636                          * a zero-length tcp_urp_mark_mp message, that message
3637                          * is tagged with MSGMARKNEXT. Sending up these
3638                          * MSGMARKNEXT messages makes SIOCATMARK work correctly
3639                          * even though the T_EXDATA_IND will not be sent up
3640                          * until the urgent byte arrives.
3641                          */
3642                         if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3643                                 if (seg_len != 0) {
3644                                         flags |= TH_MARKNEXT_NEEDED;
3645                                         freemsg(tcp->tcp_urp_mark_mp);
3646                                         tcp->tcp_urp_mark_mp = NULL;
3647                                         flags &= ~TH_SEND_URP_MARK;
3648                                 } else if (tcp->tcp_urp_mark_mp != NULL) {
3649                                         flags |= TH_SEND_URP_MARK;
3650                                         tcp->tcp_urp_mark_mp->b_flag &=
3651                                             ~MSGNOTMARKNEXT;
3652                                         tcp->tcp_urp_mark_mp->b_flag |=
3653                                             MSGMARKNEXT;
3654                                 }
3655                         }
3656 #ifdef DEBUG
3657                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3658                             "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3659                             seg_len, flags,
3660                             tcp_display(tcp, NULL, DISP_PORT_ONLY));
3661 #endif /* DEBUG */
3662                 }
3663 #ifdef DEBUG
3664                 else {
3665                         /* Data left until we hit mark */
3666                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3667                             "tcp_rput: URP %d bytes left, %s",
3668                             urp - seg_len, tcp_display(tcp, NULL,
3669                             DISP_PORT_ONLY));
3670                 }
3671 #endif /* DEBUG */
3672         }
3673 
3674 process_ack:
3675         if (!(flags & TH_ACK)) {
3676                 freemsg(mp);
3677                 goto xmit_check;
3678         }
3679         }
3680         bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3681 
3682         if (bytes_acked > 0)
3683                 tcp->tcp_ip_forward_progress = B_TRUE;
3684         if (tcp->tcp_state == TCPS_SYN_RCVD) {
3685                 /*
3686                  * tcp_sendmsg() checks tcp_state without entering
3687                  * the squeue so tcp_state should be updated before
3688                  * sending up a connection confirmation or a new
3689                  * connection indication.
3690                  */
3691                 tcp->tcp_state = TCPS_ESTABLISHED;
3692 
3693                 /*
3694                  * We are seeing the final ack in the three way
3695                  * hand shake of a active open'ed connection
3696                  * so we must send up a T_CONN_CON
3697                  */
3698                 if (tcp->tcp_active_open) {
3699                         if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3700                                 freemsg(mp);
3701                                 tcp->tcp_state = TCPS_SYN_RCVD;
3702                                 return;
3703                         }
3704                         /*
3705                          * Don't fuse the loopback endpoints for
3706                          * simultaneous active opens.
3707                          */
3708                         if (tcp->tcp_loopback) {
3709                                 TCP_STAT(tcps, tcp_fusion_unfusable);
3710                                 tcp->tcp_unfusable = B_TRUE;
3711                         }
3712                         /*
3713                          * For simultaneous active open, trace receipt of final
3714                          * ACK as tcp:::connect-established.
3715                          */
3716                         DTRACE_TCP5(connect__established, mblk_t *, NULL,
3717                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3718                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3719                 } else if (IPCL_IS_NONSTR(connp)) {
3720                         /*
3721                          * 3-way handshake has completed, so notify socket
3722                          * of the new connection.
3723                          *
3724                          * We are here means eager is fine but it can
3725                          * get a TH_RST at any point between now and till
3726                          * accept completes and disappear. We need to
3727                          * ensure that reference to eager is valid after
3728                          * we get out of eager's perimeter. So we do
3729                          * an extra refhold.
3730                          */
3731                         CONN_INC_REF(connp);
3732 
3733                         if (!tcp_newconn_notify(tcp, ira)) {
3734                                 /*
3735                                  * The state-change probe for SYN_RCVD ->
3736                                  * ESTABLISHED has not fired yet. We reset
3737                                  * the state to SYN_RCVD so that future
3738                                  * state-change probes report correct state
3739                                  * transistions.
3740                                  */
3741                                 tcp->tcp_state = TCPS_SYN_RCVD;
3742                                 freemsg(mp);
3743                                 /* notification did not go up, so drop ref */
3744                                 CONN_DEC_REF(connp);
3745                                 /* ... and close the eager */
3746                                 ASSERT(TCP_IS_DETACHED(tcp));
3747                                 (void) tcp_close_detached(tcp);
3748                                 return;
3749                         }
3750                         /*
3751                          * For passive open, trace receipt of final ACK as
3752                          * tcp:::accept-established.
3753                          */
3754                         DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3755                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3756                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3757                 } else {
3758                         /*
3759                          * 3-way handshake complete - this is a STREAMS based
3760                          * socket, so pass up the T_CONN_IND.
3761                          */
3762                         tcp_t   *listener = tcp->tcp_listener;
3763                         mblk_t  *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3764 
3765                         tcp->tcp_tconnind_started = B_TRUE;
3766                         tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3767                         ASSERT(mp != NULL);
3768                         /*
3769                          * We are here means eager is fine but it can
3770                          * get a TH_RST at any point between now and till
3771                          * accept completes and disappear. We need to
3772                          * ensure that reference to eager is valid after
3773                          * we get out of eager's perimeter. So we do
3774                          * an extra refhold.
3775                          */
3776                         CONN_INC_REF(connp);
3777 
3778                         /*
3779                          * The listener also exists because of the refhold
3780                          * done in tcp_input_listener. Its possible that it
3781                          * might have closed. We will check that once we
3782                          * get inside listeners context.
3783                          */
3784                         CONN_INC_REF(listener->tcp_connp);
3785                         if (listener->tcp_connp->conn_sqp ==
3786                             connp->conn_sqp) {
3787                                 /*
3788                                  * We optimize by not calling an SQUEUE_ENTER
3789                                  * on the listener since we know that the
3790                                  * listener and eager squeues are the same.
3791                                  * We are able to make this check safely only
3792                                  * because neither the eager nor the listener
3793                                  * can change its squeue. Only an active connect
3794                                  * can change its squeue
3795                                  */
3796                                 tcp_send_conn_ind(listener->tcp_connp, mp,
3797                                     listener->tcp_connp->conn_sqp);
3798                                 CONN_DEC_REF(listener->tcp_connp);
3799                         } else if (!tcp->tcp_loopback) {
3800                                 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3801                                     mp, tcp_send_conn_ind,
3802                                     listener->tcp_connp, NULL, SQ_FILL,
3803                                     SQTAG_TCP_CONN_IND);
3804                         } else {
3805                                 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3806                                     mp, tcp_send_conn_ind,
3807                                     listener->tcp_connp, NULL, SQ_NODRAIN,
3808                                     SQTAG_TCP_CONN_IND);
3809                         }
3810                         /*
3811                          * For passive open, trace receipt of final ACK as
3812                          * tcp:::accept-established.
3813                          */
3814                         DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3815                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3816                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3817                 }
3818                 TCPS_CONN_INC(tcps);
3819 
3820                 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3821                 bytes_acked--;
3822                 /* SYN was acked - making progress */
3823                 tcp->tcp_ip_forward_progress = B_TRUE;
3824 
3825                 /*
3826                  * If SYN was retransmitted, need to reset all
3827                  * retransmission info as this segment will be
3828                  * treated as a dup ACK.
3829                  */
3830                 if (tcp->tcp_rexmit) {
3831                         tcp->tcp_rexmit = B_FALSE;
3832                         tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3833                         tcp->tcp_rexmit_max = tcp->tcp_snxt;
3834                         tcp->tcp_snd_burst = tcp->tcp_localnet ?
3835                             TCP_CWND_INFINITE : TCP_CWND_NORMAL;
3836                         tcp->tcp_ms_we_have_waited = 0;
3837                         tcp->tcp_cwnd = mss;
3838                 }
3839 
3840                 /*
3841                  * We set the send window to zero here.
3842                  * This is needed if there is data to be
3843                  * processed already on the queue.
3844                  * Later (at swnd_update label), the
3845                  * "new_swnd > tcp_swnd" condition is satisfied
3846                  * the XMIT_NEEDED flag is set in the current
3847                  * (SYN_RCVD) state. This ensures tcp_wput_data() is
3848                  * called if there is already data on queue in
3849                  * this state.
3850                  */
3851                 tcp->tcp_swnd = 0;
3852 
3853                 if (new_swnd > tcp->tcp_max_swnd)
3854                         tcp->tcp_max_swnd = new_swnd;
3855                 tcp->tcp_swl1 = seg_seq;
3856                 tcp->tcp_swl2 = seg_ack;
3857                 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3858 
3859                 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3860                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3861                     connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3862                     int32_t, TCPS_SYN_RCVD);
3863 
3864                 /* Fuse when both sides are in ESTABLISHED state */
3865                 if (tcp->tcp_loopback && do_tcp_fusion)
3866                         tcp_fuse(tcp, iphdr, tcpha);
3867 
3868         }
3869         /* This code follows 4.4BSD-Lite2 mostly. */
3870         if (bytes_acked < 0)
3871                 goto est;
3872 
3873         /*
3874          * If TCP is ECN capable and the congestion experience bit is
3875          * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
3876          * done once per window (or more loosely, per RTT).
3877          */
3878         if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3879                 tcp->tcp_cwr = B_FALSE;
3880         if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3881                 if (!tcp->tcp_cwr) {
3882                         npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3883                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3884                         tcp->tcp_cwnd = npkt * mss;
3885                         /*
3886                          * If the cwnd is 0, use the timer to clock out
3887                          * new segments.  This is required by the ECN spec.
3888                          */
3889                         if (npkt == 0) {
3890                                 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3891                                 /*
3892                                  * This makes sure that when the ACK comes
3893                                  * back, we will increase tcp_cwnd by 1 MSS.
3894                                  */
3895                                 tcp->tcp_cwnd_cnt = 0;
3896                         }
3897                         tcp->tcp_cwr = B_TRUE;
3898                         /*
3899                          * This marks the end of the current window of in
3900                          * flight data.  That is why we don't use
3901                          * tcp_suna + tcp_swnd.  Only data in flight can
3902                          * provide ECN info.
3903                          */
3904                         tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3905                         tcp->tcp_ecn_cwr_sent = B_FALSE;
3906                 }
3907         }
3908 
3909         mp1 = tcp->tcp_xmit_head;
3910         if (bytes_acked == 0) {
3911                 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3912                         int dupack_cnt;
3913 
3914                         TCPS_BUMP_MIB(tcps, tcpInDupAck);
3915                         /*
3916                          * Fast retransmit.  When we have seen exactly three
3917                          * identical ACKs while we have unacked data
3918                          * outstanding we take it as a hint that our peer
3919                          * dropped something.
3920                          *
3921                          * If TCP is retransmitting, don't do fast retransmit.
3922                          */
3923                         if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3924                             ! tcp->tcp_rexmit) {
3925                                 /* Do Limited Transmit */
3926                                 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3927                                     tcps->tcps_dupack_fast_retransmit) {
3928                                         /*
3929                                          * RFC 3042
3930                                          *
3931                                          * What we need to do is temporarily
3932                                          * increase tcp_cwnd so that new
3933                                          * data can be sent if it is allowed
3934                                          * by the receive window (tcp_rwnd).
3935                                          * tcp_wput_data() will take care of
3936                                          * the rest.
3937                                          *
3938                                          * If the connection is SACK capable,
3939                                          * only do limited xmit when there
3940                                          * is SACK info.
3941                                          *
3942                                          * Note how tcp_cwnd is incremented.
3943                                          * The first dup ACK will increase
3944                                          * it by 1 MSS.  The second dup ACK
3945                                          * will increase it by 2 MSS.  This
3946                                          * means that only 1 new segment will
3947                                          * be sent for each dup ACK.
3948                                          */
3949                                         if (tcp->tcp_unsent > 0 &&
3950                                             (!tcp->tcp_snd_sack_ok ||
3951                                             (tcp->tcp_snd_sack_ok &&
3952                                             tcp->tcp_notsack_list != NULL))) {
3953                                                 tcp->tcp_cwnd += mss <<
3954                                                     (tcp->tcp_dupack_cnt - 1);
3955                                                 flags |= TH_LIMIT_XMIT;
3956                                         }
3957                                 } else if (dupack_cnt ==
3958                                     tcps->tcps_dupack_fast_retransmit) {
3959 
3960                                 /*
3961                                  * If we have reduced tcp_ssthresh
3962                                  * because of ECN, do not reduce it again
3963                                  * unless it is already one window of data
3964                                  * away.  After one window of data, tcp_cwr
3965                                  * should then be cleared.  Note that
3966                                  * for non ECN capable connection, tcp_cwr
3967                                  * should always be false.
3968                                  *
3969                                  * Adjust cwnd since the duplicate
3970                                  * ack indicates that a packet was
3971                                  * dropped (due to congestion.)
3972                                  */
3973                                 if (!tcp->tcp_cwr) {
3974                                         npkt = ((tcp->tcp_snxt -
3975                                             tcp->tcp_suna) >> 1) / mss;
3976                                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3977                                             mss;
3978                                         tcp->tcp_cwnd = (npkt +
3979                                             tcp->tcp_dupack_cnt) * mss;
3980                                 }
3981                                 if (tcp->tcp_ecn_ok) {
3982                                         tcp->tcp_cwr = B_TRUE;
3983                                         tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3984                                         tcp->tcp_ecn_cwr_sent = B_FALSE;
3985                                 }
3986 
3987                                 /*
3988                                  * We do Hoe's algorithm.  Refer to her
3989                                  * paper "Improving the Start-up Behavior
3990                                  * of a Congestion Control Scheme for TCP,"
3991                                  * appeared in SIGCOMM'96.
3992                                  *
3993                                  * Save highest seq no we have sent so far.
3994                                  * Be careful about the invisible FIN byte.
3995                                  */
3996                                 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
3997                                     (tcp->tcp_unsent == 0)) {
3998                                         tcp->tcp_rexmit_max = tcp->tcp_fss;
3999                                 } else {
4000                                         tcp->tcp_rexmit_max = tcp->tcp_snxt;
4001                                 }
4002 
4003                                 /*
4004                                  * Do not allow bursty traffic during.
4005                                  * fast recovery.  Refer to Fall and Floyd's
4006                                  * paper "Simulation-based Comparisons of
4007                                  * Tahoe, Reno and SACK TCP" (in CCR?)
4008                                  * This is a best current practise.
4009                                  */
4010                                 tcp->tcp_snd_burst = TCP_CWND_SS;
4011 
4012                                 /*
4013                                  * For SACK:
4014                                  * Calculate tcp_pipe, which is the
4015                                  * estimated number of bytes in
4016                                  * network.
4017                                  *
4018                                  * tcp_fack is the highest sack'ed seq num
4019                                  * TCP has received.
4020                                  *
4021                                  * tcp_pipe is explained in the above quoted
4022                                  * Fall and Floyd's paper.  tcp_fack is
4023                                  * explained in Mathis and Mahdavi's
4024                                  * "Forward Acknowledgment: Refining TCP
4025                                  * Congestion Control" in SIGCOMM '96.
4026                                  */
4027                                 if (tcp->tcp_snd_sack_ok) {
4028                                         if (tcp->tcp_notsack_list != NULL) {
4029                                                 tcp->tcp_pipe = tcp->tcp_snxt -
4030                                                     tcp->tcp_fack;
4031                                                 tcp->tcp_sack_snxt = seg_ack;
4032                                                 flags |= TH_NEED_SACK_REXMIT;
4033                                         } else {
4034                                                 /*
4035                                                  * Always initialize tcp_pipe
4036                                                  * even though we don't have
4037                                                  * any SACK info.  If later
4038                                                  * we get SACK info and
4039                                                  * tcp_pipe is not initialized,
4040                                                  * funny things will happen.
4041                                                  */
4042                                                 tcp->tcp_pipe =
4043                                                     tcp->tcp_cwnd_ssthresh;
4044                                         }
4045                                 } else {
4046                                         flags |= TH_REXMIT_NEEDED;
4047                                 } /* tcp_snd_sack_ok */
4048 
4049                                 } else {
4050                                         /*
4051                                          * Here we perform congestion
4052                                          * avoidance, but NOT slow start.
4053                                          * This is known as the Fast
4054                                          * Recovery Algorithm.
4055                                          */
4056                                         if (tcp->tcp_snd_sack_ok &&
4057                                             tcp->tcp_notsack_list != NULL) {
4058                                                 flags |= TH_NEED_SACK_REXMIT;
4059                                                 tcp->tcp_pipe -= mss;
4060                                                 if (tcp->tcp_pipe < 0)
4061                                                         tcp->tcp_pipe = 0;
4062                                         } else {
4063                                         /*
4064                                          * We know that one more packet has
4065                                          * left the pipe thus we can update
4066                                          * cwnd.
4067                                          */
4068                                         cwnd = tcp->tcp_cwnd + mss;
4069                                         if (cwnd > tcp->tcp_cwnd_max)
4070                                                 cwnd = tcp->tcp_cwnd_max;
4071                                         tcp->tcp_cwnd = cwnd;
4072                                         if (tcp->tcp_unsent > 0)
4073                                                 flags |= TH_XMIT_NEEDED;
4074                                         }
4075                                 }
4076                         }
4077                 } else if (tcp->tcp_zero_win_probe) {
4078                         /*
4079                          * If the window has opened, need to arrange
4080                          * to send additional data.
4081                          */
4082                         if (new_swnd != 0) {
4083                                 /* tcp_suna != tcp_snxt */
4084                                 /* Packet contains a window update */
4085                                 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4086                                 tcp->tcp_zero_win_probe = 0;
4087                                 tcp->tcp_timer_backoff = 0;
4088                                 tcp->tcp_ms_we_have_waited = 0;
4089 
4090                                 /*
4091                                  * Transmit starting with tcp_suna since
4092                                  * the one byte probe is not ack'ed.
4093                                  * If TCP has sent more than one identical
4094                                  * probe, tcp_rexmit will be set.  That means
4095                                  * tcp_ss_rexmit() will send out the one
4096                                  * byte along with new data.  Otherwise,
4097                                  * fake the retransmission.
4098                                  */
4099                                 flags |= TH_XMIT_NEEDED;
4100                                 if (!tcp->tcp_rexmit) {
4101                                         tcp->tcp_rexmit = B_TRUE;
4102                                         tcp->tcp_dupack_cnt = 0;
4103                                         tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4104                                         tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4105                                 }
4106                         }
4107                 }
4108                 goto swnd_update;
4109         }
4110 
4111         /*
4112          * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4113          * If the ACK value acks something that we have not yet sent, it might
4114          * be an old duplicate segment.  Send an ACK to re-synchronize the
4115          * other side.
4116          * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4117          * state is handled above, so we can always just drop the segment and
4118          * send an ACK here.
4119          *
4120          * In the case where the peer shrinks the window, we see the new window
4121          * update, but all the data sent previously is queued up by the peer.
4122          * To account for this, in tcp_process_shrunk_swnd(), the sequence
4123          * number, which was already sent, and within window, is recorded.
4124          * tcp_snxt is then updated.
4125          *
4126          * If the window has previously shrunk, and an ACK for data not yet
4127          * sent, according to tcp_snxt is recieved, it may still be valid. If
4128          * the ACK is for data within the window at the time the window was
4129          * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4130          * the sequence number ACK'ed.
4131          *
4132          * If the ACK covers all the data sent at the time the window was
4133          * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4134          *
4135          * Should we send ACKs in response to ACK only segments?
4136          */
4137 
4138         if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4139                 if ((tcp->tcp_is_wnd_shrnk) &&
4140                     (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4141                         uint32_t data_acked_ahead_snxt;
4142 
4143                         data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4144                         tcp_update_xmit_tail(tcp, seg_ack);
4145                         tcp->tcp_unsent -= data_acked_ahead_snxt;
4146                 } else {
4147                         TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4148                         /* drop the received segment */
4149                         freemsg(mp);
4150 
4151                         /*
4152                          * Send back an ACK.  If tcp_drop_ack_unsent_cnt is
4153                          * greater than 0, check if the number of such
4154                          * bogus ACks is greater than that count.  If yes,
4155                          * don't send back any ACK.  This prevents TCP from
4156                          * getting into an ACK storm if somehow an attacker
4157                          * successfully spoofs an acceptable segment to our
4158                          * peer.  If this continues (count > 2 X threshold),
4159                          * we should abort this connection.
4160                          */
4161                         if (tcp_drop_ack_unsent_cnt > 0 &&
4162                             ++tcp->tcp_in_ack_unsent >
4163                             tcp_drop_ack_unsent_cnt) {
4164                                 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4165                                 if (tcp->tcp_in_ack_unsent > 2 *
4166                                     tcp_drop_ack_unsent_cnt) {
4167                                         (void) tcp_clean_death(tcp, EPROTO);
4168                                 }
4169                                 return;
4170                         }
4171                         mp = tcp_ack_mp(tcp);
4172                         if (mp != NULL) {
4173                                 BUMP_LOCAL(tcp->tcp_obsegs);
4174                                 TCPS_BUMP_MIB(tcps, tcpOutAck);
4175                                 tcp_send_data(tcp, mp);
4176                         }
4177                         return;
4178                 }
4179         } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4180             tcp->tcp_snxt_shrunk)) {
4181                         tcp->tcp_is_wnd_shrnk = B_FALSE;
4182         }
4183 
4184         /*
4185          * TCP gets a new ACK, update the notsack'ed list to delete those
4186          * blocks that are covered by this ACK.
4187          */
4188         if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4189                 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4190                     &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4191         }
4192 
4193         /*
4194          * If we got an ACK after fast retransmit, check to see
4195          * if it is a partial ACK.  If it is not and the congestion
4196          * window was inflated to account for the other side's
4197          * cached packets, retract it.  If it is, do Hoe's algorithm.
4198          */
4199         if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4200                 ASSERT(tcp->tcp_rexmit == B_FALSE);
4201                 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4202                         tcp->tcp_dupack_cnt = 0;
4203                         /*
4204                          * Restore the orig tcp_cwnd_ssthresh after
4205                          * fast retransmit phase.
4206                          */
4207                         if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4208                                 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4209                         }
4210                         tcp->tcp_rexmit_max = seg_ack;
4211                         tcp->tcp_cwnd_cnt = 0;
4212                         tcp->tcp_snd_burst = tcp->tcp_localnet ?
4213                             TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4214 
4215                         /*
4216                          * Remove all notsack info to avoid confusion with
4217                          * the next fast retrasnmit/recovery phase.
4218                          */
4219                         if (tcp->tcp_snd_sack_ok) {
4220                                 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4221                                     tcp);
4222                         }
4223                 } else {
4224                         if (tcp->tcp_snd_sack_ok &&
4225                             tcp->tcp_notsack_list != NULL) {
4226                                 flags |= TH_NEED_SACK_REXMIT;
4227                                 tcp->tcp_pipe -= mss;
4228                                 if (tcp->tcp_pipe < 0)
4229                                         tcp->tcp_pipe = 0;
4230                         } else {
4231                                 /*
4232                                  * Hoe's algorithm:
4233                                  *
4234                                  * Retransmit the unack'ed segment and
4235                                  * restart fast recovery.  Note that we
4236                                  * need to scale back tcp_cwnd to the
4237                                  * original value when we started fast
4238                                  * recovery.  This is to prevent overly
4239                                  * aggressive behaviour in sending new
4240                                  * segments.
4241                                  */
4242                                 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4243                                     tcps->tcps_dupack_fast_retransmit * mss;
4244                                 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4245                                 flags |= TH_REXMIT_NEEDED;
4246                         }
4247                 }
4248         } else {
4249                 tcp->tcp_dupack_cnt = 0;
4250                 if (tcp->tcp_rexmit) {
4251                         /*
4252                          * TCP is retranmitting.  If the ACK ack's all
4253                          * outstanding data, update tcp_rexmit_max and
4254                          * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
4255                          * to the correct value.
4256                          *
4257                          * Note that SEQ_LEQ() is used.  This is to avoid
4258                          * unnecessary fast retransmit caused by dup ACKs
4259                          * received when TCP does slow start retransmission
4260                          * after a time out.  During this phase, TCP may
4261                          * send out segments which are already received.
4262                          * This causes dup ACKs to be sent back.
4263                          */
4264                         if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4265                                 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4266                                         tcp->tcp_rexmit_nxt = seg_ack;
4267                                 }
4268                                 if (seg_ack != tcp->tcp_rexmit_max) {
4269                                         flags |= TH_XMIT_NEEDED;
4270                                 }
4271                         } else {
4272                                 tcp->tcp_rexmit = B_FALSE;
4273                                 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4274                                 tcp->tcp_snd_burst = tcp->tcp_localnet ?
4275                                     TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4276                         }
4277                         tcp->tcp_ms_we_have_waited = 0;
4278                 }
4279         }
4280 
4281         TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4282         TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4283         tcp->tcp_suna = seg_ack;
4284         if (tcp->tcp_zero_win_probe != 0) {
4285                 tcp->tcp_zero_win_probe = 0;
4286                 tcp->tcp_timer_backoff = 0;
4287         }
4288 
4289         /*
4290          * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4291          * Note that it cannot be the SYN being ack'ed.  The code flow
4292          * will not reach here.
4293          */
4294         if (mp1 == NULL) {
4295                 goto fin_acked;
4296         }
4297 
4298         /*
4299          * Update the congestion window.
4300          *
4301          * If TCP is not ECN capable or TCP is ECN capable but the
4302          * congestion experience bit is not set, increase the tcp_cwnd as
4303          * usual.
4304          */
4305         if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4306                 cwnd = tcp->tcp_cwnd;
4307                 add = mss;
4308 
4309                 if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4310                         /*
4311                          * This is to prevent an increase of less than 1 MSS of
4312                          * tcp_cwnd.  With partial increase, tcp_wput_data()
4313                          * may send out tinygrams in order to preserve mblk
4314                          * boundaries.
4315                          *
4316                          * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4317                          * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4318                          * increased by 1 MSS for every RTTs.
4319                          */
4320                         if (tcp->tcp_cwnd_cnt <= 0) {
4321                                 tcp->tcp_cwnd_cnt = cwnd + add;
4322                         } else {
4323                                 tcp->tcp_cwnd_cnt -= add;
4324                                 add = 0;
4325                         }
4326                 }
4327                 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4328         }
4329 
4330         /* See if the latest urgent data has been acknowledged */
4331         if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4332             SEQ_GT(seg_ack, tcp->tcp_urg))
4333                 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4334 
4335         /* Can we update the RTT estimates? */
4336         if (tcp->tcp_snd_ts_ok) {
4337                 /* Ignore zero timestamp echo-reply. */
4338                 if (tcpopt.tcp_opt_ts_ecr != 0) {
4339                         tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4340                             (int32_t)tcpopt.tcp_opt_ts_ecr);
4341                 }
4342 
4343                 /* If needed, restart the timer. */
4344                 if (tcp->tcp_set_timer == 1) {
4345                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4346                         tcp->tcp_set_timer = 0;
4347                 }
4348                 /*
4349                  * Update tcp_csuna in case the other side stops sending
4350                  * us timestamps.
4351                  */
4352                 tcp->tcp_csuna = tcp->tcp_snxt;
4353         } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4354                 /*
4355                  * An ACK sequence we haven't seen before, so get the RTT
4356                  * and update the RTO. But first check if the timestamp is
4357                  * valid to use.
4358                  */
4359                 if ((mp1->b_next != NULL) &&
4360                     SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4361                         tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4362                             (int32_t)(intptr_t)mp1->b_prev);
4363                 else
4364                         TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4365 
4366                 /* Remeber the last sequence to be ACKed */
4367                 tcp->tcp_csuna = seg_ack;
4368                 if (tcp->tcp_set_timer == 1) {
4369                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4370                         tcp->tcp_set_timer = 0;
4371                 }
4372         } else {
4373                 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4374         }
4375 
4376         /* Eat acknowledged bytes off the xmit queue. */
4377         for (;;) {
4378                 mblk_t  *mp2;
4379                 uchar_t *wptr;
4380 
4381                 wptr = mp1->b_wptr;
4382                 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4383                 bytes_acked -= (int)(wptr - mp1->b_rptr);
4384                 if (bytes_acked < 0) {
4385                         mp1->b_rptr = wptr + bytes_acked;
4386                         /*
4387                          * Set a new timestamp if all the bytes timed by the
4388                          * old timestamp have been ack'ed.
4389                          */
4390                         if (SEQ_GT(seg_ack,
4391                             (uint32_t)(uintptr_t)(mp1->b_next))) {
4392                                 mp1->b_prev =
4393                                     (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4394                                 mp1->b_next = NULL;
4395                         }
4396                         break;
4397                 }
4398                 mp1->b_next = NULL;
4399                 mp1->b_prev = NULL;
4400                 mp2 = mp1;
4401                 mp1 = mp1->b_cont;
4402 
4403                 /*
4404                  * This notification is required for some zero-copy
4405                  * clients to maintain a copy semantic. After the data
4406                  * is ack'ed, client is safe to modify or reuse the buffer.
4407                  */
4408                 if (tcp->tcp_snd_zcopy_aware &&
4409                     (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4410                         tcp_zcopy_notify(tcp);
4411                 freeb(mp2);
4412                 if (bytes_acked == 0) {
4413                         if (mp1 == NULL) {
4414                                 /* Everything is ack'ed, clear the tail. */
4415                                 tcp->tcp_xmit_tail = NULL;
4416                                 /*
4417                                  * Cancel the timer unless we are still
4418                                  * waiting for an ACK for the FIN packet.
4419                                  */
4420                                 if (tcp->tcp_timer_tid != 0 &&
4421                                     tcp->tcp_snxt == tcp->tcp_suna) {
4422                                         (void) TCP_TIMER_CANCEL(tcp,
4423                                             tcp->tcp_timer_tid);
4424                                         tcp->tcp_timer_tid = 0;
4425                                 }
4426                                 goto pre_swnd_update;
4427                         }
4428                         if (mp2 != tcp->tcp_xmit_tail)
4429                                 break;
4430                         tcp->tcp_xmit_tail = mp1;
4431                         ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4432                             (uintptr_t)INT_MAX);
4433                         tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4434                             mp1->b_rptr);
4435                         break;
4436                 }
4437                 if (mp1 == NULL) {
4438                         /*
4439                          * More was acked but there is nothing more
4440                          * outstanding.  This means that the FIN was
4441                          * just acked or that we're talking to a clown.
4442                          */
4443 fin_acked:
4444                         ASSERT(tcp->tcp_fin_sent);
4445                         tcp->tcp_xmit_tail = NULL;
4446                         if (tcp->tcp_fin_sent) {
4447                                 /* FIN was acked - making progress */
4448                                 if (!tcp->tcp_fin_acked)
4449                                         tcp->tcp_ip_forward_progress = B_TRUE;
4450                                 tcp->tcp_fin_acked = B_TRUE;
4451                                 if (tcp->tcp_linger_tid != 0 &&
4452                                     TCP_TIMER_CANCEL(tcp,
4453                                     tcp->tcp_linger_tid) >= 0) {
4454                                         tcp_stop_lingering(tcp);
4455                                         freemsg(mp);
4456                                         mp = NULL;
4457                                 }
4458                         } else {
4459                                 /*
4460                                  * We should never get here because
4461                                  * we have already checked that the
4462                                  * number of bytes ack'ed should be
4463                                  * smaller than or equal to what we
4464                                  * have sent so far (it is the
4465                                  * acceptability check of the ACK).
4466                                  * We can only get here if the send
4467                                  * queue is corrupted.
4468                                  *
4469                                  * Terminate the connection and
4470                                  * panic the system.  It is better
4471                                  * for us to panic instead of
4472                                  * continuing to avoid other disaster.
4473                                  */
4474                                 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4475                                     tcp->tcp_rnxt, TH_RST|TH_ACK);
4476                                 panic("Memory corruption "
4477                                     "detected for connection %s.",
4478                                     tcp_display(tcp, NULL,
4479                                     DISP_ADDR_AND_PORT));
4480                                 /*NOTREACHED*/
4481                         }
4482                         goto pre_swnd_update;
4483                 }
4484                 ASSERT(mp2 != tcp->tcp_xmit_tail);
4485         }
4486         if (tcp->tcp_unsent) {
4487                 flags |= TH_XMIT_NEEDED;
4488         }
4489 pre_swnd_update:
4490         tcp->tcp_xmit_head = mp1;
4491 swnd_update:
4492         /*
4493          * The following check is different from most other implementations.
4494          * For bi-directional transfer, when segments are dropped, the
4495          * "normal" check will not accept a window update in those
4496          * retransmitted segemnts.  Failing to do that, TCP may send out
4497          * segments which are outside receiver's window.  As TCP accepts
4498          * the ack in those retransmitted segments, if the window update in
4499          * the same segment is not accepted, TCP will incorrectly calculates
4500          * that it can send more segments.  This can create a deadlock
4501          * with the receiver if its window becomes zero.
4502          */
4503         if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4504             SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4505             (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4506                 /*
4507                  * The criteria for update is:
4508                  *
4509                  * 1. the segment acknowledges some data.  Or
4510                  * 2. the segment is new, i.e. it has a higher seq num. Or
4511                  * 3. the segment is not old and the advertised window is
4512                  * larger than the previous advertised window.
4513                  */
4514                 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4515                         flags |= TH_XMIT_NEEDED;
4516                 tcp->tcp_swnd = new_swnd;
4517                 if (new_swnd > tcp->tcp_max_swnd)
4518                         tcp->tcp_max_swnd = new_swnd;
4519                 tcp->tcp_swl1 = seg_seq;
4520                 tcp->tcp_swl2 = seg_ack;
4521         }
4522 est:
4523         if (tcp->tcp_state > TCPS_ESTABLISHED) {
4524 
4525                 switch (tcp->tcp_state) {
4526                 case TCPS_FIN_WAIT_1:
4527                         if (tcp->tcp_fin_acked) {
4528                                 tcp->tcp_state = TCPS_FIN_WAIT_2;
4529                                 DTRACE_TCP6(state__change, void, NULL,
4530                                     ip_xmit_attr_t *, connp->conn_ixa,
4531                                     void, NULL, tcp_t *, tcp, void, NULL,
4532                                     int32_t, TCPS_FIN_WAIT_1);
4533                                 /*
4534                                  * We implement the non-standard BSD/SunOS
4535                                  * FIN_WAIT_2 flushing algorithm.
4536                                  * If there is no user attached to this
4537                                  * TCP endpoint, then this TCP struct
4538                                  * could hang around forever in FIN_WAIT_2
4539                                  * state if the peer forgets to send us
4540                                  * a FIN.  To prevent this, we wait only
4541                                  * 2*MSL (a convenient time value) for
4542                                  * the FIN to arrive.  If it doesn't show up,
4543                                  * we flush the TCP endpoint.  This algorithm,
4544                                  * though a violation of RFC-793, has worked
4545                                  * for over 10 years in BSD systems.
4546                                  * Note: SunOS 4.x waits 675 seconds before
4547                                  * flushing the FIN_WAIT_2 connection.
4548                                  */
4549                                 TCP_TIMER_RESTART(tcp,
4550                                     tcp->tcp_fin_wait_2_flush_interval);
4551                         }
4552                         break;
4553                 case TCPS_FIN_WAIT_2:
4554                         break;  /* Shutdown hook? */
4555                 case TCPS_LAST_ACK:
4556                         freemsg(mp);
4557                         if (tcp->tcp_fin_acked) {
4558                                 (void) tcp_clean_death(tcp, 0);
4559                                 return;
4560                         }
4561                         goto xmit_check;
4562                 case TCPS_CLOSING:
4563                         if (tcp->tcp_fin_acked) {
4564                                 SET_TIME_WAIT(tcps, tcp, connp);
4565                                 DTRACE_TCP6(state__change, void, NULL,
4566                                     ip_xmit_attr_t *, connp->conn_ixa, void,
4567                                     NULL, tcp_t *, tcp, void, NULL, int32_t,
4568                                     TCPS_CLOSING);
4569                         }
4570                         /*FALLTHRU*/
4571                 case TCPS_CLOSE_WAIT:
4572                         freemsg(mp);
4573                         goto xmit_check;
4574                 default:
4575                         ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4576                         break;
4577                 }
4578         }
4579         if (flags & TH_FIN) {
4580                 /* Make sure we ack the fin */
4581                 flags |= TH_ACK_NEEDED;
4582                 if (!tcp->tcp_fin_rcvd) {
4583                         tcp->tcp_fin_rcvd = B_TRUE;
4584                         tcp->tcp_rnxt++;
4585                         tcpha = tcp->tcp_tcpha;
4586                         tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4587 
4588                         /*
4589                          * Generate the ordrel_ind at the end unless the
4590                          * conn is detached or it is a STREAMS based eager.
4591                          * In the eager case we defer the notification until
4592                          * tcp_accept_finish has run.
4593                          */
4594                         if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4595                             (tcp->tcp_listener == NULL &&
4596                             !tcp->tcp_hard_binding)))
4597                                 flags |= TH_ORDREL_NEEDED;
4598                         switch (tcp->tcp_state) {
4599                         case TCPS_SYN_RCVD:
4600                                 tcp->tcp_state = TCPS_CLOSE_WAIT;
4601                                 DTRACE_TCP6(state__change, void, NULL,
4602                                     ip_xmit_attr_t *, connp->conn_ixa,
4603                                     void, NULL, tcp_t *, tcp, void, NULL,
4604                                     int32_t, TCPS_SYN_RCVD);
4605                                 /* Keepalive? */
4606                                 break;
4607                         case TCPS_ESTABLISHED:
4608                                 tcp->tcp_state = TCPS_CLOSE_WAIT;
4609                                 DTRACE_TCP6(state__change, void, NULL,
4610                                     ip_xmit_attr_t *, connp->conn_ixa,
4611                                     void, NULL, tcp_t *, tcp, void, NULL,
4612                                     int32_t, TCPS_ESTABLISHED);
4613                                 /* Keepalive? */
4614                                 break;
4615                         case TCPS_FIN_WAIT_1:
4616                                 if (!tcp->tcp_fin_acked) {
4617                                         tcp->tcp_state = TCPS_CLOSING;
4618                                         DTRACE_TCP6(state__change, void, NULL,
4619                                             ip_xmit_attr_t *, connp->conn_ixa,
4620                                             void, NULL, tcp_t *, tcp, void,
4621                                             NULL, int32_t, TCPS_FIN_WAIT_1);
4622                                         break;
4623                                 }
4624                                 /* FALLTHRU */
4625                         case TCPS_FIN_WAIT_2:
4626                                 SET_TIME_WAIT(tcps, tcp, connp);
4627                                 DTRACE_TCP6(state__change, void, NULL,
4628                                     ip_xmit_attr_t *, connp->conn_ixa, void,
4629                                     NULL, tcp_t *, tcp, void, NULL, int32_t,
4630                                     TCPS_FIN_WAIT_2);
4631                                 if (seg_len) {
4632                                         /*
4633                                          * implies data piggybacked on FIN.
4634                                          * break to handle data.
4635                                          */
4636                                         break;
4637                                 }
4638                                 freemsg(mp);
4639                                 goto ack_check;
4640                         }
4641                 }
4642         }
4643         if (mp == NULL)
4644                 goto xmit_check;
4645         if (seg_len == 0) {
4646                 freemsg(mp);
4647                 goto xmit_check;
4648         }
4649         if (mp->b_rptr == mp->b_wptr) {
4650                 /*
4651                  * The header has been consumed, so we remove the
4652                  * zero-length mblk here.
4653                  */
4654                 mp1 = mp;
4655                 mp = mp->b_cont;
4656                 freeb(mp1);
4657         }
4658 update_ack:
4659         tcpha = tcp->tcp_tcpha;
4660         tcp->tcp_rack_cnt++;
4661         {
4662                 uint32_t cur_max;
4663 
4664                 cur_max = tcp->tcp_rack_cur_max;
4665                 if (tcp->tcp_rack_cnt >= cur_max) {
4666                         /*
4667                          * We have more unacked data than we should - send
4668                          * an ACK now.
4669                          */
4670                         flags |= TH_ACK_NEEDED;
4671                         cur_max++;
4672                         if (cur_max > tcp->tcp_rack_abs_max)
4673                                 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4674                         else
4675                                 tcp->tcp_rack_cur_max = cur_max;
4676                 } else if (TCP_IS_DETACHED(tcp)) {
4677                         /* We don't have an ACK timer for detached TCP. */
4678                         flags |= TH_ACK_NEEDED;
4679                 } else if (seg_len < mss) {
4680                         /*
4681                          * If we get a segment that is less than an mss, and we
4682                          * already have unacknowledged data, and the amount
4683                          * unacknowledged is not a multiple of mss, then we
4684                          * better generate an ACK now.  Otherwise, this may be
4685                          * the tail piece of a transaction, and we would rather
4686                          * wait for the response.
4687                          */
4688                         uint32_t udif;
4689                         ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4690                             (uintptr_t)INT_MAX);
4691                         udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4692                         if (udif && (udif % mss))
4693                                 flags |= TH_ACK_NEEDED;
4694                         else
4695                                 flags |= TH_ACK_TIMER_NEEDED;
4696                 } else {
4697                         /* Start delayed ack timer */
4698                         flags |= TH_ACK_TIMER_NEEDED;
4699                 }
4700         }
4701         tcp->tcp_rnxt += seg_len;
4702         tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4703 
4704         if (mp == NULL)
4705                 goto xmit_check;
4706 
4707         /* Update SACK list */
4708         if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4709                 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4710                     &(tcp->tcp_num_sack_blk));
4711         }
4712 
4713         if (tcp->tcp_urp_mp) {
4714                 tcp->tcp_urp_mp->b_cont = mp;
4715                 mp = tcp->tcp_urp_mp;
4716                 tcp->tcp_urp_mp = NULL;
4717                 /* Ready for a new signal. */
4718                 tcp->tcp_urp_last_valid = B_FALSE;
4719 #ifdef DEBUG
4720                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4721                     "tcp_rput: sending exdata_ind %s",
4722                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
4723 #endif /* DEBUG */
4724         }
4725 
4726         /*
4727          * Check for ancillary data changes compared to last segment.
4728          */
4729         if (connp->conn_recv_ancillary.crb_all != 0) {
4730                 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4731                 if (mp == NULL)
4732                         return;
4733         }
4734 
4735         if (IPCL_IS_NONSTR(connp)) {
4736                 /*
4737                  * Non-STREAMS socket
4738                  */
4739                 boolean_t push = flags & (TH_PUSH|TH_FIN);
4740                 int error;
4741 
4742                 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4743                     mp, seg_len, 0, &error, &push) <= 0) {
4744                         /*
4745                          * We should never be in middle of a
4746                          * fallback, the squeue guarantees that.
4747                          */
4748                         ASSERT(error != EOPNOTSUPP);
4749                         if (error == ENOSPC)
4750                                 tcp->tcp_rwnd -= seg_len;
4751                 } else if (push) {
4752                         /* PUSH bit set and sockfs is not flow controlled */
4753                         flags |= tcp_rwnd_reopen(tcp);
4754                 }
4755         } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4756                 /*
4757                  * Side queue inbound data until the accept happens.
4758                  * tcp_accept/tcp_rput drains this when the accept happens.
4759                  * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4760                  * T_EXDATA_IND) it is queued on b_next.
4761                  * XXX Make urgent data use this. Requires:
4762                  *      Removing tcp_listener check for TH_URG
4763                  *      Making M_PCPROTO and MARK messages skip the eager case
4764                  */
4765 
4766                 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4767         } else {
4768                 /* Active STREAMS socket */
4769                 if (mp->b_datap->db_type != M_DATA ||
4770                     (flags & TH_MARKNEXT_NEEDED)) {
4771                         if (tcp->tcp_rcv_list != NULL) {
4772                                 flags |= tcp_rcv_drain(tcp);
4773                         }
4774                         ASSERT(tcp->tcp_rcv_list == NULL ||
4775                             tcp->tcp_fused_sigurg);
4776 
4777                         if (flags & TH_MARKNEXT_NEEDED) {
4778 #ifdef DEBUG
4779                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4780                                     "tcp_rput: sending MSGMARKNEXT %s",
4781                                     tcp_display(tcp, NULL,
4782                                     DISP_PORT_ONLY));
4783 #endif /* DEBUG */
4784                                 mp->b_flag |= MSGMARKNEXT;
4785                                 flags &= ~TH_MARKNEXT_NEEDED;
4786                         }
4787 
4788                         if (is_system_labeled())
4789                                 tcp_setcred_data(mp, ira);
4790 
4791                         putnext(connp->conn_rq, mp);
4792                         if (!canputnext(connp->conn_rq))
4793                                 tcp->tcp_rwnd -= seg_len;
4794                 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4795                     tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4796                         if (tcp->tcp_rcv_list != NULL) {
4797                                 /*
4798                                  * Enqueue the new segment first and then
4799                                  * call tcp_rcv_drain() to send all data
4800                                  * up.  The other way to do this is to
4801                                  * send all queued data up and then call
4802                                  * putnext() to send the new segment up.
4803                                  * This way can remove the else part later
4804                                  * on.
4805                                  *
4806                                  * We don't do this to avoid one more call to
4807                                  * canputnext() as tcp_rcv_drain() needs to
4808                                  * call canputnext().
4809                                  */
4810                                 tcp_rcv_enqueue(tcp, mp, seg_len,
4811                                     ira->ira_cred);
4812                                 flags |= tcp_rcv_drain(tcp);
4813                         } else {
4814                                 if (is_system_labeled())
4815                                         tcp_setcred_data(mp, ira);
4816 
4817                                 putnext(connp->conn_rq, mp);
4818                                 if (!canputnext(connp->conn_rq))
4819                                         tcp->tcp_rwnd -= seg_len;
4820                         }
4821                 } else {
4822                         /*
4823                          * Enqueue all packets when processing an mblk
4824                          * from the co queue and also enqueue normal packets.
4825                          */
4826                         tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4827                 }
4828                 /*
4829                  * Make sure the timer is running if we have data waiting
4830                  * for a push bit. This provides resiliency against
4831                  * implementations that do not correctly generate push bits.
4832                  */
4833                 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4834                         /*
4835                          * The connection may be closed at this point, so don't
4836                          * do anything for a detached tcp.
4837                          */
4838                         if (!TCP_IS_DETACHED(tcp))
4839                                 tcp->tcp_push_tid = TCP_TIMER(tcp,
4840                                     tcp_push_timer,
4841                                     tcps->tcps_push_timer_interval);
4842                 }
4843         }
4844 
4845 xmit_check:
4846         /* Is there anything left to do? */
4847         ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4848         if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4849             TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4850             TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4851                 goto done;
4852 
4853         /* Any transmit work to do and a non-zero window? */
4854         if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4855             TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4856                 if (flags & TH_REXMIT_NEEDED) {
4857                         uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4858 
4859                         TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4860                         if (snd_size > mss)
4861                                 snd_size = mss;
4862                         if (snd_size > tcp->tcp_swnd)
4863                                 snd_size = tcp->tcp_swnd;
4864                         mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4865                             NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4866                             B_TRUE);
4867 
4868                         if (mp1 != NULL) {
4869                                 tcp->tcp_xmit_head->b_prev =
4870                                     (mblk_t *)LBOLT_FASTPATH;
4871                                 tcp->tcp_csuna = tcp->tcp_snxt;
4872                                 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4873                                 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4874                                     snd_size);
4875                                 tcp_send_data(tcp, mp1);
4876                         }
4877                 }
4878                 if (flags & TH_NEED_SACK_REXMIT) {
4879                         tcp_sack_rexmit(tcp, &flags);
4880                 }
4881                 /*
4882                  * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4883                  * out new segment.  Note that tcp_rexmit should not be
4884                  * set, otherwise TH_LIMIT_XMIT should not be set.
4885                  */
4886                 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4887                         if (!tcp->tcp_rexmit) {
4888                                 tcp_wput_data(tcp, NULL, B_FALSE);
4889                         } else {
4890                                 tcp_ss_rexmit(tcp);
4891                         }
4892                 }
4893                 /*
4894                  * Adjust tcp_cwnd back to normal value after sending
4895                  * new data segments.
4896                  */
4897                 if (flags & TH_LIMIT_XMIT) {
4898                         tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4899                         /*
4900                          * This will restart the timer.  Restarting the
4901                          * timer is used to avoid a timeout before the
4902                          * limited transmitted segment's ACK gets back.
4903                          */
4904                         if (tcp->tcp_xmit_head != NULL)
4905                                 tcp->tcp_xmit_head->b_prev =
4906                                     (mblk_t *)LBOLT_FASTPATH;
4907                 }
4908 
4909                 /* Anything more to do? */
4910                 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4911                     TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4912                         goto done;
4913         }
4914 ack_check:
4915         if (flags & TH_SEND_URP_MARK) {
4916                 ASSERT(tcp->tcp_urp_mark_mp);
4917                 ASSERT(!IPCL_IS_NONSTR(connp));
4918                 /*
4919                  * Send up any queued data and then send the mark message
4920                  */
4921                 if (tcp->tcp_rcv_list != NULL) {
4922                         flags |= tcp_rcv_drain(tcp);
4923 
4924                 }
4925                 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4926                 mp1 = tcp->tcp_urp_mark_mp;
4927                 tcp->tcp_urp_mark_mp = NULL;
4928                 if (is_system_labeled())
4929                         tcp_setcred_data(mp1, ira);
4930 
4931                 putnext(connp->conn_rq, mp1);
4932 #ifdef DEBUG
4933                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4934                     "tcp_rput: sending zero-length %s %s",
4935                     ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4936                     "MSGNOTMARKNEXT"),
4937                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
4938 #endif /* DEBUG */
4939                 flags &= ~TH_SEND_URP_MARK;
4940         }
4941         if (flags & TH_ACK_NEEDED) {
4942                 /*
4943                  * Time to send an ack for some reason.
4944                  */
4945                 mp1 = tcp_ack_mp(tcp);
4946 
4947                 if (mp1 != NULL) {
4948                         tcp_send_data(tcp, mp1);
4949                         BUMP_LOCAL(tcp->tcp_obsegs);
4950                         TCPS_BUMP_MIB(tcps, tcpOutAck);
4951                 }
4952                 if (tcp->tcp_ack_tid != 0) {
4953                         (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4954                         tcp->tcp_ack_tid = 0;
4955                 }
4956         }
4957         if (flags & TH_ACK_TIMER_NEEDED) {
4958                 /*
4959                  * Arrange for deferred ACK or push wait timeout.
4960                  * Start timer if it is not already running.
4961                  */
4962                 if (tcp->tcp_ack_tid == 0) {
4963                         tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4964                             tcp->tcp_localnet ?
4965                             tcps->tcps_local_dack_interval :
4966                             tcps->tcps_deferred_ack_interval);
4967                 }
4968         }
4969         if (flags & TH_ORDREL_NEEDED) {
4970                 /*
4971                  * Notify upper layer about an orderly release. If this is
4972                  * a non-STREAMS socket, then just make an upcall. For STREAMS
4973                  * we send up an ordrel_ind, unless this is an eager, in which
4974                  * case the ordrel will be sent when tcp_accept_finish runs.
4975                  * Note that for non-STREAMS we make an upcall even if it is an
4976                  * eager, because we have an upper handle to send it to.
4977                  */
4978                 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4979                 ASSERT(!tcp->tcp_detached);
4980 
4981                 if (IPCL_IS_NONSTR(connp)) {
4982                         ASSERT(tcp->tcp_ordrel_mp == NULL);
4983                         tcp->tcp_ordrel_done = B_TRUE;
4984                         (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4985                             SOCK_OPCTL_SHUT_RECV, 0);
4986                         goto done;
4987                 }
4988 
4989                 if (tcp->tcp_rcv_list != NULL) {
4990                         /*
4991                          * Push any mblk(s) enqueued from co processing.
4992                          */
4993                         flags |= tcp_rcv_drain(tcp);
4994                 }
4995                 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4996 
4997                 mp1 = tcp->tcp_ordrel_mp;
4998                 tcp->tcp_ordrel_mp = NULL;
4999                 tcp->tcp_ordrel_done = B_TRUE;
5000                 putnext(connp->conn_rq, mp1);
5001         }
5002 done:
5003         ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5004 }
5005 
5006 /*
5007  * Attach ancillary data to a received TCP segments for the
5008  * ancillary pieces requested by the application that are
5009  * different than they were in the previous data segment.
5010  *
5011  * Save the "current" values once memory allocation is ok so that
5012  * when memory allocation fails we can just wait for the next data segment.
5013  */
5014 static mblk_t *
5015 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5016     ip_recv_attr_t *ira)
5017 {
5018         struct T_optdata_ind *todi;
5019         int optlen;
5020         uchar_t *optptr;
5021         struct T_opthdr *toh;
5022         crb_t addflag;  /* Which pieces to add */
5023         mblk_t *mp1;
5024         conn_t  *connp = tcp->tcp_connp;
5025 
5026         optlen = 0;
5027         addflag.crb_all = 0;
5028         /* If app asked for pktinfo and the index has changed ... */
5029         if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5030             ira->ira_ruifindex != tcp->tcp_recvifindex) {
5031                 optlen += sizeof (struct T_opthdr) +
5032                     sizeof (struct in6_pktinfo);
5033                 addflag.crb_ip_recvpktinfo = 1;
5034         }
5035         /* If app asked for hoplimit and it has changed ... */
5036         if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5037             ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5038                 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5039                 addflag.crb_ipv6_recvhoplimit = 1;
5040         }
5041         /* If app asked for tclass and it has changed ... */
5042         if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5043             ipp->ipp_tclass != tcp->tcp_recvtclass) {
5044                 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5045                 addflag.crb_ipv6_recvtclass = 1;
5046         }
5047         /*
5048          * If app asked for hopbyhop headers and it has changed ...
5049          * For security labels, note that (1) security labels can't change on
5050          * a connected socket at all, (2) we're connected to at most one peer,
5051          * (3) if anything changes, then it must be some other extra option.
5052          */
5053         if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5054             ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5055             (ipp->ipp_fields & IPPF_HOPOPTS),
5056             ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5057                 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5058                 addflag.crb_ipv6_recvhopopts = 1;
5059                 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5060                     &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5061                     ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5062                         return (mp);
5063         }
5064         /* If app asked for dst headers before routing headers ... */
5065         if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5066             ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5067             (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5068             ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5069                 optlen += sizeof (struct T_opthdr) +
5070                     ipp->ipp_rthdrdstoptslen;
5071                 addflag.crb_ipv6_recvrthdrdstopts = 1;
5072                 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5073                     &tcp->tcp_rthdrdstoptslen,
5074                     (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5075                     ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5076                         return (mp);
5077         }
5078         /* If app asked for routing headers and it has changed ... */
5079         if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5080             ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5081             (ipp->ipp_fields & IPPF_RTHDR),
5082             ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5083                 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5084                 addflag.crb_ipv6_recvrthdr = 1;
5085                 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5086                     &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5087                     ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5088                         return (mp);
5089         }
5090         /* If app asked for dest headers and it has changed ... */
5091         if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5092             connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5093             ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5094             (ipp->ipp_fields & IPPF_DSTOPTS),
5095             ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5096                 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5097                 addflag.crb_ipv6_recvdstopts = 1;
5098                 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5099                     &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5100                     ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5101                         return (mp);
5102         }
5103 
5104         if (optlen == 0) {
5105                 /* Nothing to add */
5106                 return (mp);
5107         }
5108         mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5109         if (mp1 == NULL) {
5110                 /*
5111                  * Defer sending ancillary data until the next TCP segment
5112                  * arrives.
5113                  */
5114                 return (mp);
5115         }
5116         mp1->b_cont = mp;
5117         mp = mp1;
5118         mp->b_wptr += sizeof (*todi) + optlen;
5119         mp->b_datap->db_type = M_PROTO;
5120         todi = (struct T_optdata_ind *)mp->b_rptr;
5121         todi->PRIM_type = T_OPTDATA_IND;
5122         todi->DATA_flag = 1; /* MORE data */
5123         todi->OPT_length = optlen;
5124         todi->OPT_offset = sizeof (*todi);
5125         optptr = (uchar_t *)&todi[1];
5126         /*
5127          * If app asked for pktinfo and the index has changed ...
5128          * Note that the local address never changes for the connection.
5129          */
5130         if (addflag.crb_ip_recvpktinfo) {
5131                 struct in6_pktinfo *pkti;
5132                 uint_t ifindex;
5133 
5134                 ifindex = ira->ira_ruifindex;
5135                 toh = (struct T_opthdr *)optptr;
5136                 toh->level = IPPROTO_IPV6;
5137                 toh->name = IPV6_PKTINFO;
5138                 toh->len = sizeof (*toh) + sizeof (*pkti);
5139                 toh->status = 0;
5140                 optptr += sizeof (*toh);
5141                 pkti = (struct in6_pktinfo *)optptr;
5142                 pkti->ipi6_addr = connp->conn_laddr_v6;
5143                 pkti->ipi6_ifindex = ifindex;
5144                 optptr += sizeof (*pkti);
5145                 ASSERT(OK_32PTR(optptr));
5146                 /* Save as "last" value */
5147                 tcp->tcp_recvifindex = ifindex;
5148         }
5149         /* If app asked for hoplimit and it has changed ... */
5150         if (addflag.crb_ipv6_recvhoplimit) {
5151                 toh = (struct T_opthdr *)optptr;
5152                 toh->level = IPPROTO_IPV6;
5153                 toh->name = IPV6_HOPLIMIT;
5154                 toh->len = sizeof (*toh) + sizeof (uint_t);
5155                 toh->status = 0;
5156                 optptr += sizeof (*toh);
5157                 *(uint_t *)optptr = ipp->ipp_hoplimit;
5158                 optptr += sizeof (uint_t);
5159                 ASSERT(OK_32PTR(optptr));
5160                 /* Save as "last" value */
5161                 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5162         }
5163         /* If app asked for tclass and it has changed ... */
5164         if (addflag.crb_ipv6_recvtclass) {
5165                 toh = (struct T_opthdr *)optptr;
5166                 toh->level = IPPROTO_IPV6;
5167                 toh->name = IPV6_TCLASS;
5168                 toh->len = sizeof (*toh) + sizeof (uint_t);
5169                 toh->status = 0;
5170                 optptr += sizeof (*toh);
5171                 *(uint_t *)optptr = ipp->ipp_tclass;
5172                 optptr += sizeof (uint_t);
5173                 ASSERT(OK_32PTR(optptr));
5174                 /* Save as "last" value */
5175                 tcp->tcp_recvtclass = ipp->ipp_tclass;
5176         }
5177         if (addflag.crb_ipv6_recvhopopts) {
5178                 toh = (struct T_opthdr *)optptr;
5179                 toh->level = IPPROTO_IPV6;
5180                 toh->name = IPV6_HOPOPTS;
5181                 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5182                 toh->status = 0;
5183                 optptr += sizeof (*toh);
5184                 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5185                 optptr += ipp->ipp_hopoptslen;
5186                 ASSERT(OK_32PTR(optptr));
5187                 /* Save as last value */
5188                 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5189                     (ipp->ipp_fields & IPPF_HOPOPTS),
5190                     ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5191         }
5192         if (addflag.crb_ipv6_recvrthdrdstopts) {
5193                 toh = (struct T_opthdr *)optptr;
5194                 toh->level = IPPROTO_IPV6;
5195                 toh->name = IPV6_RTHDRDSTOPTS;
5196                 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5197                 toh->status = 0;
5198                 optptr += sizeof (*toh);
5199                 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5200                 optptr += ipp->ipp_rthdrdstoptslen;
5201                 ASSERT(OK_32PTR(optptr));
5202                 /* Save as last value */
5203                 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5204                     &tcp->tcp_rthdrdstoptslen,
5205                     (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5206                     ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5207         }
5208         if (addflag.crb_ipv6_recvrthdr) {
5209                 toh = (struct T_opthdr *)optptr;
5210                 toh->level = IPPROTO_IPV6;
5211                 toh->name = IPV6_RTHDR;
5212                 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5213                 toh->status = 0;
5214                 optptr += sizeof (*toh);
5215                 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5216                 optptr += ipp->ipp_rthdrlen;
5217                 ASSERT(OK_32PTR(optptr));
5218                 /* Save as last value */
5219                 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5220                     (ipp->ipp_fields & IPPF_RTHDR),
5221                     ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5222         }
5223         if (addflag.crb_ipv6_recvdstopts) {
5224                 toh = (struct T_opthdr *)optptr;
5225                 toh->level = IPPROTO_IPV6;
5226                 toh->name = IPV6_DSTOPTS;
5227                 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5228                 toh->status = 0;
5229                 optptr += sizeof (*toh);
5230                 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5231                 optptr += ipp->ipp_dstoptslen;
5232                 ASSERT(OK_32PTR(optptr));
5233                 /* Save as last value */
5234                 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5235                     (ipp->ipp_fields & IPPF_DSTOPTS),
5236                     ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5237         }
5238         ASSERT(optptr == mp->b_wptr);
5239         return (mp);
5240 }
5241 
5242 /* The minimum of smoothed mean deviation in RTO calculation. */
5243 #define TCP_SD_MIN      400
5244 
5245 /*
5246  * Set RTO for this connection.  The formula is from Jacobson and Karels'
5247  * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
5248  * are the same as those in Appendix A.2 of that paper.
5249  *
5250  * m = new measurement
5251  * sa = smoothed RTT average (8 * average estimates).
5252  * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5253  */
5254 static void
5255 tcp_set_rto(tcp_t *tcp, clock_t rtt)
5256 {
5257         long m = TICK_TO_MSEC(rtt);
5258         clock_t sa = tcp->tcp_rtt_sa;
5259         clock_t sv = tcp->tcp_rtt_sd;
5260         clock_t rto;
5261         tcp_stack_t     *tcps = tcp->tcp_tcps;
5262 
5263         TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5264         tcp->tcp_rtt_update++;
5265 
5266         /* tcp_rtt_sa is not 0 means this is a new sample. */
5267         if (sa != 0) {
5268                 /*
5269                  * Update average estimator:
5270                  *      new rtt = 7/8 old rtt + 1/8 Error
5271                  */
5272 
5273                 /* m is now Error in estimate. */
5274                 m -= sa >> 3;
5275                 if ((sa += m) <= 0) {
5276                         /*
5277                          * Don't allow the smoothed average to be negative.
5278                          * We use 0 to denote reinitialization of the
5279                          * variables.
5280                          */
5281                         sa = 1;
5282                 }
5283 
5284                 /*
5285                  * Update deviation estimator:
5286                  *      new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5287                  */
5288                 if (m < 0)
5289                         m = -m;
5290                 m -= sv >> 2;
5291                 sv += m;
5292         } else {
5293                 /*
5294                  * This follows BSD's implementation.  So the reinitialized
5295                  * RTO is 3 * m.  We cannot go less than 2 because if the
5296                  * link is bandwidth dominated, doubling the window size
5297                  * during slow start means doubling the RTT.  We want to be
5298                  * more conservative when we reinitialize our estimates.  3
5299                  * is just a convenient number.
5300                  */
5301                 sa = m << 3;
5302                 sv = m << 1;
5303         }
5304         if (sv < TCP_SD_MIN) {
5305                 /*
5306                  * We do not know that if sa captures the delay ACK
5307                  * effect as in a long train of segments, a receiver
5308                  * does not delay its ACKs.  So set the minimum of sv
5309                  * to be TCP_SD_MIN, which is default to 400 ms, twice
5310                  * of BSD DATO.  That means the minimum of mean
5311                  * deviation is 100 ms.
5312                  *
5313                  */
5314                 sv = TCP_SD_MIN;
5315         }
5316         tcp->tcp_rtt_sa = sa;
5317         tcp->tcp_rtt_sd = sv;
5318         /*
5319          * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5320          *
5321          * Add tcp_rexmit_interval extra in case of extreme environment
5322          * where the algorithm fails to work.  The default value of
5323          * tcp_rexmit_interval_extra should be 0.
5324          *
5325          * As we use a finer grained clock than BSD and update
5326          * RTO for every ACKs, add in another .25 of RTT to the
5327          * deviation of RTO to accomodate burstiness of 1/4 of
5328          * window size.
5329          */
5330         rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5331 
5332         TCP_SET_RTO(tcp, rto);
5333 
5334         /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5335         tcp->tcp_timer_backoff = 0;
5336 }
5337 
5338 /*
5339  * On a labeled system we have some protocols above TCP, such as RPC, which
5340  * appear to assume that every mblk in a chain has a db_credp.
5341  */
5342 static void
5343 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5344 {
5345         ASSERT(is_system_labeled());
5346         ASSERT(ira->ira_cred != NULL);
5347 
5348         while (mp != NULL) {
5349                 mblk_setcred(mp, ira->ira_cred, NOPID);
5350                 mp = mp->b_cont;
5351         }
5352 }
5353 
5354 uint_t
5355 tcp_rwnd_reopen(tcp_t *tcp)
5356 {
5357         uint_t ret = 0;
5358         uint_t thwin;
5359         conn_t *connp = tcp->tcp_connp;
5360 
5361         /* Learn the latest rwnd information that we sent to the other side. */
5362         thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5363             << tcp->tcp_rcv_ws;
5364         /* This is peer's calculated send window (our receive window). */
5365         thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5366         /*
5367          * Increase the receive window to max.  But we need to do receiver
5368          * SWS avoidance.  This means that we need to check the increase of
5369          * of receive window is at least 1 MSS.
5370          */
5371         if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5372                 /*
5373                  * If the window that the other side knows is less than max
5374                  * deferred acks segments, send an update immediately.
5375                  */
5376                 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5377                         TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5378                         ret = TH_ACK_NEEDED;
5379                 }
5380                 tcp->tcp_rwnd = connp->conn_rcvbuf;
5381         }
5382         return (ret);
5383 }
5384 
5385 /*
5386  * Handle a packet that has been reclassified by TCP.
5387  * This function drops the ref on connp that the caller had.
5388  */
5389 void
5390 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5391 {
5392         ipsec_stack_t   *ipss = ipst->ips_netstack->netstack_ipsec;
5393 
5394         if (connp->conn_incoming_ifindex != 0 &&
5395             connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5396                 freemsg(mp);
5397                 CONN_DEC_REF(connp);
5398                 return;
5399         }
5400 
5401         if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5402             (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5403                 ip6_t *ip6h;
5404                 ipha_t *ipha;
5405 
5406                 if (ira->ira_flags & IRAF_IS_IPV4) {
5407                         ipha = (ipha_t *)mp->b_rptr;
5408                         ip6h = NULL;
5409                 } else {
5410                         ipha = NULL;
5411                         ip6h = (ip6_t *)mp->b_rptr;
5412                 }
5413                 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5414                 if (mp == NULL) {
5415                         BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5416                         /* Note that mp is NULL */
5417                         ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5418                         CONN_DEC_REF(connp);
5419                         return;
5420                 }
5421         }
5422 
5423         if (IPCL_IS_TCP(connp)) {
5424                 /*
5425                  * do not drain, certain use cases can blow
5426                  * the stack
5427                  */
5428                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5429                     connp->conn_recv, connp, ira,
5430                     SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5431         } else {
5432                 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5433                 (connp->conn_recv)(connp, mp, NULL,
5434                     ira);
5435                 CONN_DEC_REF(connp);
5436         }
5437 
5438 }
5439 
5440 /* ARGSUSED */
5441 static void
5442 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5443 {
5444         conn_t  *connp = (conn_t *)arg;
5445         tcp_t   *tcp = connp->conn_tcp;
5446         queue_t *q = connp->conn_rq;
5447 
5448         ASSERT(!IPCL_IS_NONSTR(connp));
5449         mutex_enter(&tcp->tcp_rsrv_mp_lock);
5450         tcp->tcp_rsrv_mp = mp;
5451         mutex_exit(&tcp->tcp_rsrv_mp_lock);
5452 
5453         if (TCP_IS_DETACHED(tcp) || q == NULL) {
5454                 return;
5455         }
5456 
5457         if (tcp->tcp_fused) {
5458                 tcp_fuse_backenable(tcp);
5459                 return;
5460         }
5461 
5462         if (canputnext(q)) {
5463                 /* Not flow-controlled, open rwnd */
5464                 tcp->tcp_rwnd = connp->conn_rcvbuf;
5465 
5466                 /*
5467                  * Send back a window update immediately if TCP is above
5468                  * ESTABLISHED state and the increase of the rcv window
5469                  * that the other side knows is at least 1 MSS after flow
5470                  * control is lifted.
5471                  */
5472                 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5473                     tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5474                         tcp_xmit_ctl(NULL, tcp,
5475                             (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5476                             tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5477                 }
5478         }
5479 }
5480 
5481 /*
5482  * The read side service routine is called mostly when we get back-enabled as a
5483  * result of flow control relief.  Since we don't actually queue anything in
5484  * TCP, we have no data to send out of here.  What we do is clear the receive
5485  * window, and send out a window update.
5486  */
5487 void
5488 tcp_rsrv(queue_t *q)
5489 {
5490         conn_t          *connp = Q_TO_CONN(q);
5491         tcp_t           *tcp = connp->conn_tcp;
5492         mblk_t          *mp;
5493 
5494         /* No code does a putq on the read side */
5495         ASSERT(q->q_first == NULL);
5496 
5497         /*
5498          * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5499          * been run.  So just return.
5500          */
5501         mutex_enter(&tcp->tcp_rsrv_mp_lock);
5502         if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5503                 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5504                 return;
5505         }
5506         tcp->tcp_rsrv_mp = NULL;
5507         mutex_exit(&tcp->tcp_rsrv_mp_lock);
5508 
5509         CONN_INC_REF(connp);
5510         SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5511             NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5512 }
5513 
5514 /* At minimum we need 8 bytes in the TCP header for the lookup */
5515 #define ICMP_MIN_TCP_HDR        8
5516 
5517 /*
5518  * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5519  * passed up by IP. The message is always received on the correct tcp_t.
5520  * Assumes that IP has pulled up everything up to and including the ICMP header.
5521  */
5522 /* ARGSUSED2 */
5523 void
5524 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5525 {
5526         conn_t          *connp = (conn_t *)arg1;
5527         icmph_t         *icmph;
5528         ipha_t          *ipha;
5529         int             iph_hdr_length;
5530         tcpha_t         *tcpha;
5531         uint32_t        seg_seq;
5532         tcp_t           *tcp = connp->conn_tcp;
5533 
5534         /* Assume IP provides aligned packets */
5535         ASSERT(OK_32PTR(mp->b_rptr));
5536         ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5537 
5538         /*
5539          * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5540          * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5541          */
5542         if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5543                 tcp_icmp_error_ipv6(tcp, mp, ira);
5544                 return;
5545         }
5546 
5547         /* Skip past the outer IP and ICMP headers */
5548         iph_hdr_length = ira->ira_ip_hdr_length;
5549         icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5550         /*
5551          * If we don't have the correct outer IP header length
5552          * or if we don't have a complete inner IP header
5553          * drop it.
5554          */
5555         if (iph_hdr_length < sizeof (ipha_t) ||
5556             (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5557 noticmpv4:
5558                 freemsg(mp);
5559                 return;
5560         }
5561         ipha = (ipha_t *)&icmph[1];
5562 
5563         /* Skip past the inner IP and find the ULP header */
5564         iph_hdr_length = IPH_HDR_LENGTH(ipha);
5565         tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5566         /*
5567          * If we don't have the correct inner IP header length or if the ULP
5568          * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5569          * bytes of TCP header, drop it.
5570          */
5571         if (iph_hdr_length < sizeof (ipha_t) ||
5572             ipha->ipha_protocol != IPPROTO_TCP ||
5573             (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5574                 goto noticmpv4;
5575         }
5576 
5577         seg_seq = ntohl(tcpha->tha_seq);
5578         switch (icmph->icmph_type) {
5579         case ICMP_DEST_UNREACHABLE:
5580                 switch (icmph->icmph_code) {
5581                 case ICMP_FRAGMENTATION_NEEDED:
5582                         /*
5583                          * Update Path MTU, then try to send something out.
5584                          */
5585                         tcp_update_pmtu(tcp, B_TRUE);
5586                         tcp_rexmit_after_error(tcp);
5587                         break;
5588                 case ICMP_PORT_UNREACHABLE:
5589                 case ICMP_PROTOCOL_UNREACHABLE:
5590                         switch (tcp->tcp_state) {
5591                         case TCPS_SYN_SENT:
5592                         case TCPS_SYN_RCVD:
5593                                 /*
5594                                  * ICMP can snipe away incipient
5595                                  * TCP connections as long as
5596                                  * seq number is same as initial
5597                                  * send seq number.
5598                                  */
5599                                 if (seg_seq == tcp->tcp_iss) {
5600                                         (void) tcp_clean_death(tcp,
5601                                             ECONNREFUSED);
5602                                 }
5603                                 break;
5604                         }
5605                         break;
5606                 case ICMP_HOST_UNREACHABLE:
5607                 case ICMP_NET_UNREACHABLE:
5608                         /* Record the error in case we finally time out. */
5609                         if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5610                                 tcp->tcp_client_errno = EHOSTUNREACH;
5611                         else
5612                                 tcp->tcp_client_errno = ENETUNREACH;
5613                         if (tcp->tcp_state == TCPS_SYN_RCVD) {
5614                                 if (tcp->tcp_listener != NULL &&
5615                                     tcp->tcp_listener->tcp_syn_defense) {
5616                                         /*
5617                                          * Ditch the half-open connection if we
5618                                          * suspect a SYN attack is under way.
5619                                          */
5620                                         (void) tcp_clean_death(tcp,
5621                                             tcp->tcp_client_errno);
5622                                 }
5623                         }
5624                         break;
5625                 default:
5626                         break;
5627                 }
5628                 break;
5629         case ICMP_SOURCE_QUENCH: {
5630                 /*
5631                  * use a global boolean to control
5632                  * whether TCP should respond to ICMP_SOURCE_QUENCH.
5633                  * The default is false.
5634                  */
5635                 if (tcp_icmp_source_quench) {
5636                         /*
5637                          * Reduce the sending rate as if we got a
5638                          * retransmit timeout
5639                          */
5640                         uint32_t npkt;
5641 
5642                         npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5643                             tcp->tcp_mss;
5644                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5645                         tcp->tcp_cwnd = tcp->tcp_mss;
5646                         tcp->tcp_cwnd_cnt = 0;
5647                 }
5648                 break;
5649         }
5650         }
5651         freemsg(mp);
5652 }
5653 
5654 /*
5655  * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5656  * error messages passed up by IP.
5657  * Assumes that IP has pulled up all the extension headers as well
5658  * as the ICMPv6 header.
5659  */
5660 static void
5661 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5662 {
5663         icmp6_t         *icmp6;
5664         ip6_t           *ip6h;
5665         uint16_t        iph_hdr_length = ira->ira_ip_hdr_length;
5666         tcpha_t         *tcpha;
5667         uint8_t         *nexthdrp;
5668         uint32_t        seg_seq;
5669 
5670         /*
5671          * Verify that we have a complete IP header.
5672          */
5673         ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5674 
5675         icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5676         ip6h = (ip6_t *)&icmp6[1];
5677         /*
5678          * Verify if we have a complete ICMP and inner IP header.
5679          */
5680         if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5681 noticmpv6:
5682                 freemsg(mp);
5683                 return;
5684         }
5685 
5686         if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5687                 goto noticmpv6;
5688         tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5689         /*
5690          * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5691          * have at least ICMP_MIN_TCP_HDR bytes of  TCP header drop the
5692          * packet.
5693          */
5694         if ((*nexthdrp != IPPROTO_TCP) ||
5695             ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5696                 goto noticmpv6;
5697         }
5698 
5699         seg_seq = ntohl(tcpha->tha_seq);
5700         switch (icmp6->icmp6_type) {
5701         case ICMP6_PACKET_TOO_BIG:
5702                 /*
5703                  * Update Path MTU, then try to send something out.
5704                  */
5705                 tcp_update_pmtu(tcp, B_TRUE);
5706                 tcp_rexmit_after_error(tcp);
5707                 break;
5708         case ICMP6_DST_UNREACH:
5709                 switch (icmp6->icmp6_code) {
5710                 case ICMP6_DST_UNREACH_NOPORT:
5711                         if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5712                             (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5713                             (seg_seq == tcp->tcp_iss)) {
5714                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
5715                         }
5716                         break;
5717                 case ICMP6_DST_UNREACH_ADMIN:
5718                 case ICMP6_DST_UNREACH_NOROUTE:
5719                 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5720                 case ICMP6_DST_UNREACH_ADDR:
5721                         /* Record the error in case we finally time out. */
5722                         tcp->tcp_client_errno = EHOSTUNREACH;
5723                         if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5724                             (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5725                             (seg_seq == tcp->tcp_iss)) {
5726                                 if (tcp->tcp_listener != NULL &&
5727                                     tcp->tcp_listener->tcp_syn_defense) {
5728                                         /*
5729                                          * Ditch the half-open connection if we
5730                                          * suspect a SYN attack is under way.
5731                                          */
5732                                         (void) tcp_clean_death(tcp,
5733                                             tcp->tcp_client_errno);
5734                                 }
5735                         }
5736 
5737 
5738                         break;
5739                 default:
5740                         break;
5741                 }
5742                 break;
5743         case ICMP6_PARAM_PROB:
5744                 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5745                 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5746                     (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5747                     (uchar_t *)nexthdrp) {
5748                         if (tcp->tcp_state == TCPS_SYN_SENT ||
5749                             tcp->tcp_state == TCPS_SYN_RCVD) {
5750                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
5751                         }
5752                         break;
5753                 }
5754                 break;
5755 
5756         case ICMP6_TIME_EXCEEDED:
5757         default:
5758                 break;
5759         }
5760         freemsg(mp);
5761 }
5762 
5763 /*
5764  * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5765  * change. But it can refer to fields like tcp_suna and tcp_snxt.
5766  *
5767  * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5768  * error messages received by IP. The message is always received on the correct
5769  * tcp_t.
5770  */
5771 /* ARGSUSED */
5772 boolean_t
5773 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5774     ip_recv_attr_t *ira)
5775 {
5776         tcpha_t         *tcpha = (tcpha_t *)arg2;
5777         uint32_t        seq = ntohl(tcpha->tha_seq);
5778         tcp_t           *tcp = connp->conn_tcp;
5779 
5780         /*
5781          * TCP sequence number contained in payload of the ICMP error message
5782          * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5783          * the message is either a stale ICMP error, or an attack from the
5784          * network. Fail the verification.
5785          */
5786         if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5787                 return (B_FALSE);
5788 
5789         /* For "too big" we also check the ignore flag */
5790         if (ira->ira_flags & IRAF_IS_IPV4) {
5791                 ASSERT(icmph != NULL);
5792                 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5793                     icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5794                     tcp->tcp_tcps->tcps_ignore_path_mtu)
5795                         return (B_FALSE);
5796         } else {
5797                 ASSERT(icmp6 != NULL);
5798                 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5799                     tcp->tcp_tcps->tcps_ignore_path_mtu)
5800                         return (B_FALSE);
5801         }
5802         return (B_TRUE);
5803 }