inet/sctp/sctp_input.c

0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * CDDL HEADER START
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
1676Sjpk * Common Development and Distribution License (the "License").
1676Sjpk * You may not use this file except in compliance with the License.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
0Sstevel@tonic-gate * See the License for the specific language governing permissions
0Sstevel@tonic-gate * and limitations under the License.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * CDDL HEADER END
0Sstevel@tonic-gate */
1735Skcpoon
0Sstevel@tonic-gate/*
1676Sjpk * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
0Sstevel@tonic-gate * Use is subject to license terms.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate
0Sstevel@tonic-gate#pragma ident	"%Z%%M%	%I%	%E% SMI"
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <sys/types.h>
0Sstevel@tonic-gate#include <sys/systm.h>
0Sstevel@tonic-gate#include <sys/stream.h>
0Sstevel@tonic-gate#include <sys/cmn_err.h>
0Sstevel@tonic-gate#include <sys/kmem.h>
0Sstevel@tonic-gate#define	_SUN_TPI_VERSION 2
0Sstevel@tonic-gate#include <sys/tihdr.h>
0Sstevel@tonic-gate#include <sys/socket.h>
0Sstevel@tonic-gate#include <sys/strsun.h>
0Sstevel@tonic-gate#include <sys/strsubr.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <netinet/in.h>
0Sstevel@tonic-gate#include <netinet/ip6.h>
0Sstevel@tonic-gate#include <netinet/tcp_seq.h>
0Sstevel@tonic-gate#include <netinet/sctp.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <inet/common.h>
0Sstevel@tonic-gate#include <inet/ip.h>
0Sstevel@tonic-gate#include <inet/ip6.h>
0Sstevel@tonic-gate#include <inet/mib2.h>
0Sstevel@tonic-gate#include <inet/ipclassifier.h>
0Sstevel@tonic-gate#include <inet/ipp_common.h>
0Sstevel@tonic-gate#include <inet/ipsec_impl.h>
0Sstevel@tonic-gate#include <inet/sctp_ip.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include "sctp_impl.h"
0Sstevel@tonic-gate#include "sctp_asconf.h"
0Sstevel@tonic-gate#include "sctp_addr.h"
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic struct kmem_cache *sctp_kmem_set_cache;
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * PR-SCTP comments.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * When we get a valid Forward TSN chunk, we check the fragment list for this
0Sstevel@tonic-gate * SSN and preceeding SSNs free all them. Further, if this Forward TSN causes
0Sstevel@tonic-gate * the next expected SSN to be present in the stream queue, we deliver any
0Sstevel@tonic-gate * such stranded messages upstream. We also update the SACK info. appropriately.
0Sstevel@tonic-gate * When checking for advancing the cumulative ack (in sctp_cumack()) we must
0Sstevel@tonic-gate * check for abandoned chunks and messages. While traversing the tramsmit
0Sstevel@tonic-gate * list if we come across an abandoned chunk, we can skip the message (i.e.
0Sstevel@tonic-gate * take it out of the (re)transmit list) since this message, and hence this
0Sstevel@tonic-gate * chunk, has been marked abandoned by sctp_rexmit(). If we come across an
0Sstevel@tonic-gate * unsent chunk for a message this now abandoned we need to check if a
0Sstevel@tonic-gate * Forward TSN needs to be sent, this could be a case where we deferred sending
0Sstevel@tonic-gate * a Forward TSN in sctp_get_msg_to_send(). Further, after processing a
0Sstevel@tonic-gate * SACK we check if the Advanced peer ack point can be moved ahead, i.e.
0Sstevel@tonic-gate * if we can send a Forward TSN via sctp_check_abandoned_data().
0Sstevel@tonic-gate */
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_free_set(sctp_set_t *s)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	while (s) {
0Sstevel@tonic-gate		p = s->next;
0Sstevel@tonic-gate		kmem_cache_free(sctp_kmem_set_cache, s);
0Sstevel@tonic-gate		s = p;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_ack_add(sctp_set_t **head, uint32_t tsn, int *num)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p, *t;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (head == NULL || num == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(*num >= 0);
0Sstevel@tonic-gate	ASSERT((*num == 0 && *head == NULL) || (*num > 0 && *head != NULL));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (*head == NULL) {
0Sstevel@tonic-gate		*head = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate		if (*head == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		(*head)->prev = (*head)->next = NULL;
0Sstevel@tonic-gate		(*head)->begin = tsn;
0Sstevel@tonic-gate		(*head)->end = tsn;
0Sstevel@tonic-gate		*num = 1;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT((*head)->prev == NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Handle this special case here so we don't have to check
0Sstevel@tonic-gate	 * for it each time in the loop.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(tsn + 1, (*head)->begin)) {
0Sstevel@tonic-gate		/* add a new set, and move the head pointer */
0Sstevel@tonic-gate		t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate		if (t == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		t->next = *head;
0Sstevel@tonic-gate		t->prev = NULL;
0Sstevel@tonic-gate		(*head)->prev = t;
0Sstevel@tonic-gate		t->begin = tsn;
0Sstevel@tonic-gate		t->end = tsn;
0Sstevel@tonic-gate		(*num)++;
0Sstevel@tonic-gate		*head = t;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We need to handle the following cases, where p points to
0Sstevel@tonic-gate	 * the current set (as we walk through the loop):
0Sstevel@tonic-gate	 *
0Sstevel@tonic-gate	 * 1. tsn is entirely less than p; create a new set before p.
0Sstevel@tonic-gate	 * 2. tsn borders p from less; coalesce p with tsn.
0Sstevel@tonic-gate	 * 3. tsn is withing p; do nothing.
0Sstevel@tonic-gate	 * 4. tsn borders p from greater; coalesce p with tsn.
0Sstevel@tonic-gate	 * 4a. p may now border p->next from less; if so, coalesce those
0Sstevel@tonic-gate	 *    two sets.
0Sstevel@tonic-gate	 * 5. tsn is entirely greater then all sets; add a new set at
0Sstevel@tonic-gate	 *    the end.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	for (p = *head; ; p = p->next) {
0Sstevel@tonic-gate		if (SEQ_LT(tsn + 1, p->begin)) {
0Sstevel@tonic-gate			/* 1: add a new set before p. */
0Sstevel@tonic-gate			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate			if (t == NULL)
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			t->next = p;
0Sstevel@tonic-gate			t->prev = NULL;
0Sstevel@tonic-gate			t->begin = tsn;
0Sstevel@tonic-gate			t->end = tsn;
0Sstevel@tonic-gate			if (p->prev) {
0Sstevel@tonic-gate				t->prev = p->prev;
0Sstevel@tonic-gate				p->prev->next = t;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			p->prev = t;
0Sstevel@tonic-gate			(*num)++;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if ((tsn + 1) == p->begin) {
0Sstevel@tonic-gate			/* 2: adjust p->begin */
0Sstevel@tonic-gate			p->begin = tsn;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (SEQ_GEQ(tsn, p->begin) && SEQ_LEQ(tsn, p->end)) {
0Sstevel@tonic-gate			/* 3; do nothing */
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if ((p->end + 1) == tsn) {
0Sstevel@tonic-gate			/* 4; adjust p->end */
0Sstevel@tonic-gate			p->end = tsn;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			if (p->next != NULL && (tsn + 1) == p->next->begin) {
0Sstevel@tonic-gate				/* 4a: coalesce p and p->next */
0Sstevel@tonic-gate				t = p->next;
0Sstevel@tonic-gate				p->end = t->end;
0Sstevel@tonic-gate				p->next = t->next;
0Sstevel@tonic-gate				if (t->next != NULL)
0Sstevel@tonic-gate					t->next->prev = p;
0Sstevel@tonic-gate				kmem_cache_free(sctp_kmem_set_cache, t);
0Sstevel@tonic-gate				(*num)--;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (p->next == NULL) {
0Sstevel@tonic-gate			/* 5: add new set at the end */
0Sstevel@tonic-gate			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate			if (t == NULL)
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			t->next = NULL;
0Sstevel@tonic-gate			t->prev = p;
0Sstevel@tonic-gate			t->begin = tsn;
0Sstevel@tonic-gate			t->end = tsn;
0Sstevel@tonic-gate			p->next = t;
0Sstevel@tonic-gate			(*num)++;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (SEQ_GT(tsn, p->end + 1))
0Sstevel@tonic-gate			continue;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_ack_rem(sctp_set_t **head, uint32_t end, int *num)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p, *t;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (head == NULL || *head == NULL || num == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Nothing to remove */
0Sstevel@tonic-gate	if (SEQ_LT(end, (*head)->begin))
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Find out where to start removing sets */
0Sstevel@tonic-gate	for (p = *head; p->next; p = p->next) {
0Sstevel@tonic-gate		if (SEQ_LEQ(end, p->end))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (SEQ_LT(end, p->end) && SEQ_GEQ(end, p->begin)) {
0Sstevel@tonic-gate		/* adjust p */
0Sstevel@tonic-gate		p->begin = end + 1;
0Sstevel@tonic-gate		/* all done */
0Sstevel@tonic-gate		if (p == *head)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate	} else if (SEQ_GEQ(end, p->end)) {
0Sstevel@tonic-gate		/* remove this set too */
0Sstevel@tonic-gate		p = p->next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* unlink everything before this set */
0Sstevel@tonic-gate	t = *head;
0Sstevel@tonic-gate	*head = p;
0Sstevel@tonic-gate	if (p != NULL && p->prev != NULL) {
0Sstevel@tonic-gate		p->prev->next = NULL;
0Sstevel@tonic-gate		p->prev = NULL;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_free_set(t);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* recount the number of sets */
0Sstevel@tonic-gate	*num = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	for (p = *head; p != NULL; p = p->next)
0Sstevel@tonic-gate		(*num)++;
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_sets_init()
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_kmem_set_cache = kmem_cache_create("sctp_set_cache",
0Sstevel@tonic-gate	    sizeof (sctp_set_t), 0, NULL, NULL, NULL, NULL,
0Sstevel@tonic-gate	    NULL, 0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_sets_fini()
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	kmem_cache_destroy(sctp_kmem_set_cache);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatesctp_chunk_hdr_t *
0Sstevel@tonic-gatesctp_first_chunk(uchar_t *rptr, ssize_t remaining)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t *ch;
0Sstevel@tonic-gate	uint16_t ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (remaining < sizeof (*ch)) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch = (sctp_chunk_hdr_t *)rptr;
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (ch_len < sizeof (*ch) || remaining < ch_len) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (ch);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatesctp_chunk_hdr_t *
0Sstevel@tonic-gatesctp_next_chunk(sctp_chunk_hdr_t *ch, ssize_t *remaining)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	int pad;
0Sstevel@tonic-gate	uint16_t ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (!ch) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if ((pad = ch_len & (SCTP_ALIGN - 1)) != 0) {
0Sstevel@tonic-gate		pad = SCTP_ALIGN - pad;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*remaining -= (ch_len + pad);
0Sstevel@tonic-gate	ch = (sctp_chunk_hdr_t *)((char *)ch + ch_len + pad);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (sctp_first_chunk((uchar_t *)ch, *remaining));
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Attach ancillary data to a received SCTP segments.
0Sstevel@tonic-gate * If the source address (fp) is not the primary, send up a
0Sstevel@tonic-gate * unitdata_ind so recvfrom() can populate the msg_name field.
0Sstevel@tonic-gate * If ancillary data is also requested, we append it to the
0Sstevel@tonic-gate * unitdata_req. Otherwise, we just send up an optdata_ind.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_input_add_ancillary(sctp_t *sctp, mblk_t **mp, sctp_data_hdr_t *dcp,
0Sstevel@tonic-gate    sctp_faddr_t *fp, ip6_pkt_t *ipp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	struct T_unitdata_ind	*tudi;
0Sstevel@tonic-gate	int			optlen;
0Sstevel@tonic-gate	int			hdrlen;
0Sstevel@tonic-gate	uchar_t			*optptr;
0Sstevel@tonic-gate	struct cmsghdr		*cmsg;
0Sstevel@tonic-gate	mblk_t			*mp1;
0Sstevel@tonic-gate	struct sockaddr_in6	sin_buf[1];
0Sstevel@tonic-gate	struct sockaddr_in6	*sin6;
0Sstevel@tonic-gate	struct sockaddr_in	*sin4;
0Sstevel@tonic-gate	uint_t			addflag = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sin4 = NULL;
0Sstevel@tonic-gate	sin6 = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	optlen = hdrlen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Figure out address size */
0Sstevel@tonic-gate	if (sctp->sctp_ipversion == IPV4_VERSION) {
0Sstevel@tonic-gate		sin4 = (struct sockaddr_in *)sin_buf;
0Sstevel@tonic-gate		sin4->sin_family = AF_INET;
0Sstevel@tonic-gate		sin4->sin_port = sctp->sctp_fport;
0Sstevel@tonic-gate		IN6_V4MAPPED_TO_IPADDR(&fp->faddr, sin4->sin_addr.s_addr);
0Sstevel@tonic-gate		hdrlen = sizeof (*tudi) + sizeof (*sin4);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sin6 = sin_buf;
0Sstevel@tonic-gate		sin6->sin6_family = AF_INET6;
0Sstevel@tonic-gate		sin6->sin6_port = sctp->sctp_fport;
0Sstevel@tonic-gate		sin6->sin6_addr = fp->faddr;
0Sstevel@tonic-gate		hdrlen = sizeof (*tudi) + sizeof (*sin6);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* If app asked to receive send / recv info */
0Sstevel@tonic-gate	if (sctp->sctp_recvsndrcvinfo) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (struct sctp_sndrcvinfo);
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_optdata_ind);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_ipv6_recvancillary == 0)
0Sstevel@tonic-gate		goto noancillary;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if ((ipp->ipp_fields & IPPF_IFINDEX) &&
0Sstevel@tonic-gate	    ipp->ipp_ifindex != sctp->sctp_recvifindex &&
0Sstevel@tonic-gate	    (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVPKTINFO)) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (struct in6_pktinfo);
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate		addflag |= SCTP_IPV6_RECVPKTINFO;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hoplimit and it has changed ... */
0Sstevel@tonic-gate	if ((ipp->ipp_fields & IPPF_HOPLIMIT) &&
0Sstevel@tonic-gate	    ipp->ipp_hoplimit != sctp->sctp_recvhops &&
0Sstevel@tonic-gate	    (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPLIMIT)) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (uint_t);
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate		addflag |= SCTP_IPV6_RECVHOPLIMIT;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hopbyhop headers and it has changed ... */
0Sstevel@tonic-gate	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPOPTS) &&
1676Sjpk	    ip_cmpbuf(sctp->sctp_hopopts, sctp->sctp_hopoptslen,
0Sstevel@tonic-gate		(ipp->ipp_fields & IPPF_HOPOPTS),
0Sstevel@tonic-gate		ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
1676Sjpk		optlen += sizeof (*cmsg) + ipp->ipp_hopoptslen -
1676Sjpk		    sctp->sctp_v6label_len;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate		addflag |= SCTP_IPV6_RECVHOPOPTS;
1676Sjpk		if (!ip_allocbuf((void **)&sctp->sctp_hopopts,
0Sstevel@tonic-gate		    &sctp->sctp_hopoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_HOPOPTS),
0Sstevel@tonic-gate		    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for dst headers before routing headers ... */
0Sstevel@tonic-gate	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTDSTOPTS) &&
1676Sjpk	    ip_cmpbuf(sctp->sctp_rtdstopts, sctp->sctp_rtdstoptslen,
0Sstevel@tonic-gate		(ipp->ipp_fields & IPPF_RTDSTOPTS),
0Sstevel@tonic-gate		ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + ipp->ipp_rtdstoptslen;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate		addflag |= SCTP_IPV6_RECVRTDSTOPTS;
1676Sjpk		if (!ip_allocbuf((void **)&sctp->sctp_rtdstopts,
0Sstevel@tonic-gate		    &sctp->sctp_rtdstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTDSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for routing headers and it has changed ... */
0Sstevel@tonic-gate	if (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTHDR) {
1676Sjpk		if (ip_cmpbuf(sctp->sctp_rthdr, sctp->sctp_rthdrlen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTHDR),
0Sstevel@tonic-gate		    ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
0Sstevel@tonic-gate			optlen += sizeof (*cmsg) + ipp->ipp_rthdrlen;
0Sstevel@tonic-gate			if (hdrlen == 0)
0Sstevel@tonic-gate				hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate			addflag |= SCTP_IPV6_RECVRTHDR;
1676Sjpk			if (!ip_allocbuf((void **)&sctp->sctp_rthdr,
0Sstevel@tonic-gate			    &sctp->sctp_rthdrlen,
0Sstevel@tonic-gate			    (ipp->ipp_fields & IPPF_RTHDR),
0Sstevel@tonic-gate			    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
0Sstevel@tonic-gate				return (-1);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for dest headers and it has changed ... */
0Sstevel@tonic-gate	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVDSTOPTS) &&
1676Sjpk	    ip_cmpbuf(sctp->sctp_dstopts, sctp->sctp_dstoptslen,
0Sstevel@tonic-gate		(ipp->ipp_fields & IPPF_DSTOPTS),
0Sstevel@tonic-gate		ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
0Sstevel@tonic-gate		addflag |= SCTP_IPV6_RECVDSTOPTS;
1676Sjpk		if (!ip_allocbuf((void **)&sctp->sctp_dstopts,
0Sstevel@tonic-gate		    &sctp->sctp_dstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_DSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gatenoancillary:
0Sstevel@tonic-gate	/* Nothing to add */
0Sstevel@tonic-gate	if (hdrlen == 0)
0Sstevel@tonic-gate		return (-1);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mp1 = allocb(hdrlen + optlen + sizeof (void *), BPRI_MED);
0Sstevel@tonic-gate	if (mp1 == NULL)
0Sstevel@tonic-gate		return (-1);
0Sstevel@tonic-gate	mp1->b_cont = *mp;
0Sstevel@tonic-gate	*mp = mp1;
0Sstevel@tonic-gate	mp1->b_rptr += sizeof (void *);  /* pointer worth of padding */
0Sstevel@tonic-gate	mp1->b_wptr = mp1->b_rptr + hdrlen + optlen;
0Sstevel@tonic-gate	DB_TYPE(mp1) = M_PROTO;
0Sstevel@tonic-gate	tudi = (struct T_unitdata_ind *)mp1->b_rptr;
0Sstevel@tonic-gate	tudi->PRIM_type = T_UNITDATA_IND;
0Sstevel@tonic-gate	tudi->SRC_length = sin4 ? sizeof (*sin4) : sizeof (*sin6);
0Sstevel@tonic-gate	tudi->SRC_offset = sizeof (*tudi);
0Sstevel@tonic-gate	tudi->OPT_offset = sizeof (*tudi) + tudi->SRC_length;
0Sstevel@tonic-gate	tudi->OPT_length = optlen;
0Sstevel@tonic-gate	if (sin4) {
0Sstevel@tonic-gate		bcopy(sin4, tudi + 1, sizeof (*sin4));
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		bcopy(sin6, tudi + 1, sizeof (*sin6));
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	optptr = (uchar_t *)tudi + tudi->OPT_offset;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_recvsndrcvinfo) {
0Sstevel@tonic-gate		/* XXX need backout method if memory allocation fails. */
0Sstevel@tonic-gate		struct sctp_sndrcvinfo *sri;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_SCTP;
0Sstevel@tonic-gate		cmsg->cmsg_type = SCTP_SNDRCV;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*sri);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sri = (struct sctp_sndrcvinfo *)(cmsg + 1);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(sri));
0Sstevel@tonic-gate		sri->sinfo_stream = ntohs(dcp->sdh_sid);
0Sstevel@tonic-gate		sri->sinfo_ssn = ntohs(dcp->sdh_ssn);
0Sstevel@tonic-gate		if (SCTP_DATA_GET_UBIT(dcp)) {
0Sstevel@tonic-gate			sri->sinfo_flags = MSG_UNORDERED;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			sri->sinfo_flags = 0;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sri->sinfo_ppid = dcp->sdh_payload_id;
0Sstevel@tonic-gate		sri->sinfo_context = 0;
0Sstevel@tonic-gate		sri->sinfo_timetolive = 0;
0Sstevel@tonic-gate		sri->sinfo_tsn = ntohl(dcp->sdh_tsn);
0Sstevel@tonic-gate		sri->sinfo_cumtsn = sctp->sctp_ftsn;
0Sstevel@tonic-gate		sri->sinfo_assoc_id = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		optptr += sizeof (*sri);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If app asked for pktinfo and the index has changed ...
0Sstevel@tonic-gate	 * Note that the local address never changes for the connection.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVPKTINFO) {
0Sstevel@tonic-gate		struct in6_pktinfo *pkti;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_PKTINFO;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*pkti);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		pkti = (struct in6_pktinfo *)optptr;
0Sstevel@tonic-gate		if (sctp->sctp_ipversion == IPV6_VERSION)
0Sstevel@tonic-gate			pkti->ipi6_addr = sctp->sctp_ip6h->ip6_src;
0Sstevel@tonic-gate		else
0Sstevel@tonic-gate			IN6_IPADDR_TO_V4MAPPED(sctp->sctp_ipha->ipha_src,
0Sstevel@tonic-gate			    &pkti->ipi6_addr);
0Sstevel@tonic-gate		pkti->ipi6_ifindex = ipp->ipp_ifindex;
0Sstevel@tonic-gate		optptr += sizeof (*pkti);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as "last" value */
0Sstevel@tonic-gate		sctp->sctp_recvifindex = ipp->ipp_ifindex;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hoplimit and it has changed ... */
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVHOPLIMIT) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_HOPLIMIT;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (uint_t);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		*(uint_t *)optptr = ipp->ipp_hoplimit;
0Sstevel@tonic-gate		optptr += sizeof (uint_t);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as "last" value */
0Sstevel@tonic-gate		sctp->sctp_recvhops = ipp->ipp_hoplimit;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVHOPOPTS) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_HOPOPTS;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_hopoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
0Sstevel@tonic-gate		optptr += ipp->ipp_hopoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_hopopts,
0Sstevel@tonic-gate		    &sctp->sctp_hopoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_HOPOPTS),
0Sstevel@tonic-gate		    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVRTDSTOPTS) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_RTHDRDSTOPTS;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rtdstoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen);
0Sstevel@tonic-gate		optptr += ipp->ipp_rtdstoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_rtdstopts,
0Sstevel@tonic-gate		    &sctp->sctp_rtdstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTDSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVRTHDR) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_RTHDR;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rthdrlen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
0Sstevel@tonic-gate		optptr += ipp->ipp_rthdrlen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_rthdr,
0Sstevel@tonic-gate		    &sctp->sctp_rthdrlen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTHDR),
0Sstevel@tonic-gate		    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (addflag & SCTP_IPV6_RECVDSTOPTS) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_DSTOPTS;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
0Sstevel@tonic-gate		optptr += ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_dstopts,
0Sstevel@tonic-gate		    &sctp->sctp_dstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_DSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(optptr == mp1->b_wptr);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_free_reass(sctp_instr_t *sip)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *mp, *mpnext, *mctl;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	for (mp = sip->istr_reass; mp != NULL; mp = mpnext) {
0Sstevel@tonic-gate		mpnext = mp->b_next;
0Sstevel@tonic-gate		mp->b_next = NULL;
0Sstevel@tonic-gate		mp->b_prev = NULL;
0Sstevel@tonic-gate		if (DB_TYPE(mp) == M_CTL) {
0Sstevel@tonic-gate			mctl = mp;
0Sstevel@tonic-gate			ASSERT(mp->b_cont != NULL);
0Sstevel@tonic-gate			mp = mp->b_cont;
0Sstevel@tonic-gate			mctl->b_cont = NULL;
0Sstevel@tonic-gate			freeb(mctl);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		freemsg(mp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * If the series of data fragments of which dmp is a part is successfully
0Sstevel@tonic-gate * reassembled, the first mblk in the series is returned. dc is adjusted
0Sstevel@tonic-gate * to point at the data chunk in the lead mblk, and b_rptr also points to
0Sstevel@tonic-gate * the data chunk; the following mblk's b_rptr's point at the actual payload.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * If the series is not yet reassembled, NULL is returned. dc is not changed.
0Sstevel@tonic-gate * XXX should probably move this up into the state machine.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate
0Sstevel@tonic-gate/* Fragment list for un-ordered messages. Partial delivery is not supported */
0Sstevel@tonic-gatestatic mblk_t *
0Sstevel@tonic-gatesctp_uodata_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*begin = NULL;
0Sstevel@tonic-gate	mblk_t		*end = NULL;
0Sstevel@tonic-gate	sctp_data_hdr_t	*qdc;
0Sstevel@tonic-gate	uint32_t	ntsn;
0Sstevel@tonic-gate	uint32_t	tsn = ntohl((*dc)->sdh_tsn);
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	mblk_t		*mp1;
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* First frag. */
0Sstevel@tonic-gate	if (sctp->sctp_uo_frags == NULL) {
0Sstevel@tonic-gate		sctp->sctp_uo_frags = dmp;
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	hmp = sctp->sctp_uo_frags;
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Insert the segment according to the TSN, fragmented unordered
0Sstevel@tonic-gate	 * chunks are sequenced by TSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate		if (SEQ_GT(ntsn, tsn)) {
0Sstevel@tonic-gate			if (hmp->b_prev == NULL) {
0Sstevel@tonic-gate				dmp->b_next = hmp;
0Sstevel@tonic-gate				hmp->b_prev = dmp;
0Sstevel@tonic-gate				sctp->sctp_uo_frags = dmp;
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				dmp->b_next = hmp;
0Sstevel@tonic-gate				dmp->b_prev = hmp->b_prev;
0Sstevel@tonic-gate				hmp->b_prev->b_next = dmp;
0Sstevel@tonic-gate				hmp->b_prev = dmp;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (hmp->b_next == NULL) {
0Sstevel@tonic-gate			hmp->b_next = dmp;
0Sstevel@tonic-gate			dmp->b_prev = hmp;
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		hmp = hmp->b_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* check if we completed a msg */
0Sstevel@tonic-gate	if (SCTP_DATA_GET_BBIT(*dc)) {
0Sstevel@tonic-gate		begin = dmp;
0Sstevel@tonic-gate	} else if (SCTP_DATA_GET_EBIT(*dc)) {
0Sstevel@tonic-gate		end = dmp;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We walk consecutive TSNs backwards till we get a seg. with
0Sstevel@tonic-gate	 * the B bit
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (begin == NULL) {
0Sstevel@tonic-gate		for (hmp = dmp->b_prev; hmp != NULL; hmp = hmp->b_prev) {
0Sstevel@tonic-gate			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate			ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate			if ((int32_t)(tsn - ntsn) > 1) {
0Sstevel@tonic-gate				return (NULL);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (SCTP_DATA_GET_BBIT(qdc)) {
0Sstevel@tonic-gate				begin = hmp;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			tsn = ntsn;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	tsn = ntohl((*dc)->sdh_tsn);
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We walk consecutive TSNs till we get a seg. with the E bit
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (end == NULL) {
0Sstevel@tonic-gate		for (hmp = dmp->b_next; hmp != NULL; hmp = hmp->b_next) {
0Sstevel@tonic-gate			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate			ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate			if ((int32_t)(ntsn - tsn) > 1) {
0Sstevel@tonic-gate				return (NULL);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (SCTP_DATA_GET_EBIT(qdc)) {
0Sstevel@tonic-gate				end = hmp;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			tsn = ntsn;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (begin == NULL || end == NULL) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Got one!, Remove the msg from the list */
0Sstevel@tonic-gate	if (sctp->sctp_uo_frags == begin) {
0Sstevel@tonic-gate		ASSERT(begin->b_prev == NULL);
0Sstevel@tonic-gate		sctp->sctp_uo_frags = end->b_next;
0Sstevel@tonic-gate		if (end->b_next != NULL)
0Sstevel@tonic-gate			end->b_next->b_prev = NULL;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		begin->b_prev->b_next = end->b_next;
0Sstevel@tonic-gate		if (end->b_next != NULL)
0Sstevel@tonic-gate			end->b_next->b_prev = begin->b_prev;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	begin->b_prev = NULL;
0Sstevel@tonic-gate	end->b_next = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Null out b_next and b_prev and chain using b_cont.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	dmp = end = begin;
0Sstevel@tonic-gate	hmp = begin->b_next;
0Sstevel@tonic-gate	*dc = (sctp_data_hdr_t *)begin->b_rptr;
0Sstevel@tonic-gate	begin->b_next = NULL;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		hmp->b_rptr = (uchar_t *)(qdc + 1);
0Sstevel@tonic-gate		end = hmp->b_next;
0Sstevel@tonic-gate		dmp->b_cont = hmp;
0Sstevel@tonic-gate		dmp = hmp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (end != NULL)
0Sstevel@tonic-gate			hmp->b_next = NULL;
0Sstevel@tonic-gate		hmp->b_prev = NULL;
0Sstevel@tonic-gate		hmp = end;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_reassmsgs);
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	mp1 = begin;
0Sstevel@tonic-gate	while (mp1 != NULL) {
0Sstevel@tonic-gate		ASSERT(mp1->b_next == NULL);
0Sstevel@tonic-gate		ASSERT(mp1->b_prev == NULL);
0Sstevel@tonic-gate		mp1 = mp1->b_cont;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate	return (begin);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Fragment list for ordered messages.
0Sstevel@tonic-gate * If no error occures, error is set to 0. If we run out of memory, error
0Sstevel@tonic-gate * is set to 1. If the peer commits a fatal error (like using different
0Sstevel@tonic-gate * sequence numbers for the same data fragment series), the association is
0Sstevel@tonic-gate * aborted and error is set to 2.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic mblk_t *
0Sstevel@tonic-gatesctp_data_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc, int *error,
0Sstevel@tonic-gate    sctp_instr_t *sip, int trypartial, int *tpfinished)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*pmp;
0Sstevel@tonic-gate	mblk_t		*qmp;
0Sstevel@tonic-gate	mblk_t		*mp;
0Sstevel@tonic-gate	mblk_t		*prev;
0Sstevel@tonic-gate	mblk_t		*prevprev;
0Sstevel@tonic-gate	mblk_t		*first_mp;
0Sstevel@tonic-gate	sctp_reass_t	*srp;
0Sstevel@tonic-gate	sctp_data_hdr_t	*qdc;
0Sstevel@tonic-gate	sctp_data_hdr_t	*bdc;
0Sstevel@tonic-gate	sctp_data_hdr_t	*edc;
0Sstevel@tonic-gate	uint32_t	tsn;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We can overwrite the Link Layer + IP header here, I suppose.
0Sstevel@tonic-gate	 * The M_CTL does not leave this function. We need to check
0Sstevel@tonic-gate	 * DB_REF(dmp) before using DB_BASE(dmp), since there could be
0Sstevel@tonic-gate	 * two fragments for different ssns in the same mblk.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate#define	SCTP_NEW_REASS(nmp, dmp, srp, seterror)				\
0Sstevel@tonic-gate	if ((DB_REF(dmp) == 2) && (MBLKHEAD(dmp) >= 			\
3106Sgeorges	    (sizeof (*(srp)) + sizeof (sctp_hdr_t))) &&			\
3106Sgeorges	    (IS_P2ALIGNED(DB_BASE(dmp), sizeof (uintptr_t)))) {		\
0Sstevel@tonic-gate		(nmp) = (dmp);						\
0Sstevel@tonic-gate	} else {							\
0Sstevel@tonic-gate		(nmp) = allocb(sizeof (*(srp)), BPRI_MED); 		\
0Sstevel@tonic-gate		if ((nmp) == NULL) {					\
0Sstevel@tonic-gate			switch (seterror) {				\
0Sstevel@tonic-gate			case B_TRUE:					\
0Sstevel@tonic-gate				*error = 1;				\
0Sstevel@tonic-gate				break;					\
0Sstevel@tonic-gate			}						\
0Sstevel@tonic-gate			return (NULL);					\
0Sstevel@tonic-gate		}							\
0Sstevel@tonic-gate		DB_TYPE(nmp) = M_CTL;					\
0Sstevel@tonic-gate		(nmp)->b_cont = dmp;					\
0Sstevel@tonic-gate	}								\
0Sstevel@tonic-gate	(srp) = (sctp_reass_t *)DB_BASE(nmp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*error = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* find the reassembly queue for this data chunk */
0Sstevel@tonic-gate	hmp = qmp = sip->istr_reass;
0Sstevel@tonic-gate	for (; hmp != NULL; hmp = hmp->b_next) {
0Sstevel@tonic-gate		srp = (sctp_reass_t *)DB_BASE(hmp);
0Sstevel@tonic-gate		if (ntohs((*dc)->sdh_ssn) == srp->ssn)
0Sstevel@tonic-gate			goto foundit;
0Sstevel@tonic-gate		else if (SSN_GT(srp->ssn, ntohs((*dc)->sdh_ssn)))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		qmp = hmp;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE);
0Sstevel@tonic-gate	srp->ssn = ntohs((*dc)->sdh_ssn);
0Sstevel@tonic-gate	srp->needed = 0;
0Sstevel@tonic-gate	srp->got = 1;
0Sstevel@tonic-gate	srp->tail = dmp;
0Sstevel@tonic-gate	srp->partial_delivered = B_FALSE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (hmp != NULL) {
0Sstevel@tonic-gate		if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate			sip->istr_reass = pmp;
0Sstevel@tonic-gate			pmp->b_next = hmp;
0Sstevel@tonic-gate			pmp->b_prev = NULL;
0Sstevel@tonic-gate			hmp->b_prev = pmp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			qmp->b_next = pmp;
0Sstevel@tonic-gate			pmp->b_prev = qmp;
0Sstevel@tonic-gate			pmp->b_next = hmp;
0Sstevel@tonic-gate			hmp->b_prev = pmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* make a new reass head and stick it on the end */
0Sstevel@tonic-gate		if (sip->istr_reass == NULL) {
0Sstevel@tonic-gate			sip->istr_reass = pmp;
0Sstevel@tonic-gate			pmp->b_prev = NULL;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			qmp->b_next = pmp;
0Sstevel@tonic-gate			pmp->b_prev = qmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		pmp->b_next = NULL;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (NULL);
0Sstevel@tonic-gatefoundit:
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * else already have a reassembly queue. Insert the new data chunk
0Sstevel@tonic-gate	 * in the reassemble queue. Try the tail first, on the assumption
0Sstevel@tonic-gate	 * that the fragments are coming in in order.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate
0Sstevel@tonic-gate	qmp = srp->tail;
0Sstevel@tonic-gate	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate	ASSERT(qmp->b_cont == NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* XXXIs it fine to do this just here? */
0Sstevel@tonic-gate	if ((*dc)->sdh_sid != qdc->sdh_sid) {
0Sstevel@tonic-gate		/* our peer is fatally confused; XXX abort the assc */
0Sstevel@tonic-gate		*error = 2;
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (SEQ_GT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
0Sstevel@tonic-gate		qmp->b_cont = dmp;
0Sstevel@tonic-gate		srp->tail = dmp;
0Sstevel@tonic-gate		dmp->b_cont = NULL;
0Sstevel@tonic-gate		goto inserted;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Next check for insertion at the beginning */
0Sstevel@tonic-gate	qmp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont;
0Sstevel@tonic-gate	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate	if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
0Sstevel@tonic-gate		if (DB_TYPE(hmp) == M_DATA) {
0Sstevel@tonic-gate			sctp_reass_t	*srp1 = srp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE);
0Sstevel@tonic-gate			ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL);
0Sstevel@tonic-gate			if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate				sip->istr_reass = pmp;
0Sstevel@tonic-gate				if (hmp->b_next != NULL) {
0Sstevel@tonic-gate					hmp->b_next->b_prev = pmp;
0Sstevel@tonic-gate					pmp->b_next = hmp->b_next;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				hmp->b_prev->b_next = pmp;
0Sstevel@tonic-gate				pmp->b_prev = hmp->b_prev;
0Sstevel@tonic-gate				if (hmp->b_next != NULL) {
0Sstevel@tonic-gate					hmp->b_next->b_prev = pmp;
0Sstevel@tonic-gate					pmp->b_next = hmp->b_next;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			srp->ssn = srp1->ssn;
0Sstevel@tonic-gate			srp->needed = srp1->needed;
0Sstevel@tonic-gate			srp->got = srp1->got;
0Sstevel@tonic-gate			srp->tail = srp1->tail;
0Sstevel@tonic-gate			srp->partial_delivered = srp1->partial_delivered;
0Sstevel@tonic-gate			hmp->b_next = hmp->b_prev = NULL;
0Sstevel@tonic-gate			dmp->b_cont = hmp;
0Sstevel@tonic-gate			hmp = pmp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			ASSERT(DB_TYPE(hmp) == M_CTL);
0Sstevel@tonic-gate			dmp->b_cont = qmp;
0Sstevel@tonic-gate			hmp->b_cont = dmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		goto inserted;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Insert somewhere in the middle */
0Sstevel@tonic-gate	for (;;) {
0Sstevel@tonic-gate		/* Tail check above should have caught this */
0Sstevel@tonic-gate		ASSERT(qmp->b_cont != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)qmp->b_cont->b_rptr;
0Sstevel@tonic-gate		if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
0Sstevel@tonic-gate			/* insert here */
0Sstevel@tonic-gate			dmp->b_cont = qmp->b_cont;
0Sstevel@tonic-gate			qmp->b_cont = dmp;
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		qmp = qmp->b_cont;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gateinserted:
0Sstevel@tonic-gate	(srp->got)++;
0Sstevel@tonic-gate	first_mp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont;
0Sstevel@tonic-gate	if (srp->needed == 0) {
0Sstevel@tonic-gate		/* check if we have the first and last fragments */
0Sstevel@tonic-gate		bdc = (sctp_data_hdr_t *)first_mp->b_rptr;
0Sstevel@tonic-gate		edc = (sctp_data_hdr_t *)srp->tail->b_rptr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* calculate how many fragments are needed, if possible  */
0Sstevel@tonic-gate		if (SCTP_DATA_GET_BBIT(bdc) && SCTP_DATA_GET_EBIT(edc))
0Sstevel@tonic-gate			srp->needed = ntohl(edc->sdh_tsn) -
0Sstevel@tonic-gate			    ntohl(bdc->sdh_tsn) + 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (srp->needed != srp->got) {
0Sstevel@tonic-gate		if (!trypartial)
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Try partial delivery. We need a consecutive run of
0Sstevel@tonic-gate		 * at least two chunks, starting from the first chunk
0Sstevel@tonic-gate		 * (which may have been the last + 1 chunk from a
0Sstevel@tonic-gate		 * previous partial delivery).
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		dprint(4, ("trypartial: got=%d, needed=%d\n",
0Sstevel@tonic-gate		    (int)(srp->got), (int)(srp->needed)));
0Sstevel@tonic-gate		mp = first_mp;
0Sstevel@tonic-gate		if (mp->b_cont == NULL) {
0Sstevel@tonic-gate			/* need at least two chunks */
0Sstevel@tonic-gate			dprint(4, ("trypartial: only 1 chunk\n"));
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate		if (!SCTP_DATA_GET_BBIT(qdc)) {
0Sstevel@tonic-gate			/* don't have first chunk; can't do it. */
0Sstevel@tonic-gate			dprint(4, ("trypartial: no beginning\n"));
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		tsn = ntohl(qdc->sdh_tsn) + 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * This loop has two exit conditions: the
0Sstevel@tonic-gate		 * end of received chunks has been reached, or
0Sstevel@tonic-gate		 * there is a break in the sequence. We want
0Sstevel@tonic-gate		 * to chop the reassembly list as follows (the
0Sstevel@tonic-gate		 * numbers are TSNs):
0Sstevel@tonic-gate		 *   10 -> 11 -> | 12	(end of chunks)
0Sstevel@tonic-gate		 *   10 -> 11 -> | 12 -> 14 (break in sequence)
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		prevprev = prev = mp;
0Sstevel@tonic-gate		mp = mp->b_cont;
0Sstevel@tonic-gate		while (mp != NULL) {
0Sstevel@tonic-gate			qdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			if (ntohl(qdc->sdh_tsn) != tsn) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * break in sequence.
0Sstevel@tonic-gate				 * 1st and 2nd chunks are not sequntial.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (mp == first_mp->b_cont)
0Sstevel@tonic-gate					return (NULL);
0Sstevel@tonic-gate				/* Back up mp and prev */
0Sstevel@tonic-gate				mp = prev;
0Sstevel@tonic-gate				prev = prevprev;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/* end of sequence */
0Sstevel@tonic-gate			if (mp->b_cont == NULL)
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			prevprev = prev;
0Sstevel@tonic-gate			prev = mp;
0Sstevel@tonic-gate			mp = mp->b_cont;
0Sstevel@tonic-gate			tsn++;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (DB_TYPE(hmp) == M_DATA) {
0Sstevel@tonic-gate			sctp_reass_t	*srp1 = srp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			SCTP_NEW_REASS(pmp, mp, srp, B_FALSE);
0Sstevel@tonic-gate			ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL);
0Sstevel@tonic-gate			if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate				sip->istr_reass = pmp;
0Sstevel@tonic-gate				if (hmp->b_next != NULL) {
0Sstevel@tonic-gate					hmp->b_next->b_prev = pmp;
0Sstevel@tonic-gate					pmp->b_next = hmp->b_next;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				hmp->b_prev->b_next = pmp;
0Sstevel@tonic-gate				pmp->b_prev = hmp->b_prev;
0Sstevel@tonic-gate				if (hmp->b_next != NULL) {
0Sstevel@tonic-gate					hmp->b_next->b_prev = pmp;
0Sstevel@tonic-gate					pmp->b_next = hmp->b_next;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			srp->ssn = srp1->ssn;
0Sstevel@tonic-gate			srp->needed = srp1->needed;
0Sstevel@tonic-gate			srp->got = srp1->got;
0Sstevel@tonic-gate			srp->tail = srp1->tail;
0Sstevel@tonic-gate			hmp->b_next = hmp->b_prev = NULL;
0Sstevel@tonic-gate			dmp = hmp;
0Sstevel@tonic-gate			hmp = pmp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			ASSERT(DB_TYPE(hmp) == M_CTL);
0Sstevel@tonic-gate			dmp = hmp->b_cont;
0Sstevel@tonic-gate			hmp->b_cont = mp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * mp now points at the last chunk in the sequence,
0Sstevel@tonic-gate		 * and prev points to mp's previous in the list.
0Sstevel@tonic-gate		 * We chop the list at prev, and convert mp into the
0Sstevel@tonic-gate		 * new list head by setting the B bit. Subsequence
0Sstevel@tonic-gate		 * fragment deliveries will follow the normal reassembly
0Sstevel@tonic-gate		 * path.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		prev->b_cont = NULL;
0Sstevel@tonic-gate		bdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate		SCTP_DATA_SET_BBIT(bdc);
0Sstevel@tonic-gate		*tpfinished = 0;
0Sstevel@tonic-gate		srp->partial_delivered = B_TRUE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		dprint(4, ("trypartial: got some, got=%d, needed=%d\n",
0Sstevel@tonic-gate		    (int)(srp->got), (int)(srp->needed)));
0Sstevel@tonic-gate		goto fixup;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * else reassembly done; prepare the data for delivery.
0Sstevel@tonic-gate	 * First unlink hmp from the ssn list.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate		sip->istr_reass = hmp->b_next;
0Sstevel@tonic-gate		if (hmp->b_next) {
0Sstevel@tonic-gate			hmp->b_next->b_prev = NULL;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		ASSERT(hmp->b_prev != NULL);
0Sstevel@tonic-gate		hmp->b_prev->b_next = hmp->b_next;
0Sstevel@tonic-gate		if (hmp->b_next) {
0Sstevel@tonic-gate			hmp->b_next->b_prev = hmp->b_prev;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Using b_prev and b_next was a little sinful, but OK since
0Sstevel@tonic-gate	 * this mblk is never put*'d. However, freeb() will still
0Sstevel@tonic-gate	 * ASSERT that they are unused, so we need to NULL them out now.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	hmp->b_next = NULL;
0Sstevel@tonic-gate	hmp->b_prev = NULL;
0Sstevel@tonic-gate	dmp = hmp;
0Sstevel@tonic-gate	if (DB_TYPE(hmp) == M_CTL) {
0Sstevel@tonic-gate		dmp = dmp->b_cont;
0Sstevel@tonic-gate		hmp->b_cont = NULL;
0Sstevel@tonic-gate		freeb(hmp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	*tpfinished = 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gatefixup:
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Adjust all mblk's except the lead so their rptr's point to the
0Sstevel@tonic-gate	 * payload. sctp_data_chunk() will need to process the lead's
0Sstevel@tonic-gate	 * data chunk section, so leave it's rptr pointing at the data chunk.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	*dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate	if (trypartial && !(*tpfinished)) {
0Sstevel@tonic-gate		(srp->got)--;
0Sstevel@tonic-gate		ASSERT(srp->got != 0);
0Sstevel@tonic-gate		if (srp->needed != 0) {
0Sstevel@tonic-gate			(srp->needed)--;
0Sstevel@tonic-gate			ASSERT(srp->needed != 0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	for (qmp = dmp->b_cont; qmp; qmp = qmp->b_cont) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate		qmp->b_rptr = (uchar_t *)(qdc + 1);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * If in partial delivery, deduct the balance from got
0Sstevel@tonic-gate		 * and needed here, now that we know we are actually
0Sstevel@tonic-gate		 * delivering these data.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (trypartial && !(*tpfinished)) {
0Sstevel@tonic-gate			(srp->got)--;
0Sstevel@tonic-gate			ASSERT(srp->got != 0);
0Sstevel@tonic-gate			if (srp->needed != 0) {
0Sstevel@tonic-gate				(srp->needed)--;
0Sstevel@tonic-gate				ASSERT(srp->needed != 0);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_reassmsgs);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (dmp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_add_dup(uint32_t tsn, mblk_t **dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *mp;
0Sstevel@tonic-gate	size_t bsize = SCTP_DUP_MBLK_SZ * sizeof (tsn);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (dups == NULL) {
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* first time? */
0Sstevel@tonic-gate	if (*dups == NULL) {
0Sstevel@tonic-gate		*dups = allocb(bsize, BPRI_MED);
0Sstevel@tonic-gate		if (*dups == NULL) {
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mp = *dups;
0Sstevel@tonic-gate	if ((mp->b_wptr - mp->b_rptr) >= bsize) {
0Sstevel@tonic-gate		/* maximum reached */
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* add the duplicate tsn */
0Sstevel@tonic-gate	bcopy(&tsn, mp->b_wptr, sizeof (tsn));
0Sstevel@tonic-gate	mp->b_wptr += sizeof (tsn);
0Sstevel@tonic-gate	ASSERT((mp->b_wptr - mp->b_rptr) <= bsize);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_data_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *mp, mblk_t **dups,
0Sstevel@tonic-gate    sctp_faddr_t *fp, ip6_pkt_t *ipp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_data_hdr_t *dc;
0Sstevel@tonic-gate	mblk_t *dmp, *pmp;
0Sstevel@tonic-gate	mblk_t *errmp;
0Sstevel@tonic-gate	sctp_instr_t *instr;
0Sstevel@tonic-gate	int ubit;
0Sstevel@tonic-gate	int isfrag;
0Sstevel@tonic-gate	uint16_t ssn;
0Sstevel@tonic-gate	uint32_t oftsn;
0Sstevel@tonic-gate	boolean_t can_deliver = B_TRUE;
0Sstevel@tonic-gate	uint32_t tsn;
0Sstevel@tonic-gate	int dlen;
0Sstevel@tonic-gate	int trypartial = 0;
0Sstevel@tonic-gate	int tpfinished = 1;
0Sstevel@tonic-gate	int32_t new_rwnd;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* The following are used multiple times, so we inline them */
0Sstevel@tonic-gate#define	SCTP_ACK_IT(sctp, tsn)						\
0Sstevel@tonic-gate	if (tsn == sctp->sctp_ftsn) {					\
0Sstevel@tonic-gate		dprint(2, ("data_chunk: acking next %x\n", tsn));	\
1932Svi117747		(sctp)->sctp_ftsn++;					\
1932Svi117747		if ((sctp)->sctp_sack_gaps > 0)				\
1932Svi117747			(sctp)->sctp_force_sack = 1;			\
0Sstevel@tonic-gate	} else if (SEQ_GT(tsn, sctp->sctp_ftsn)) {			\
0Sstevel@tonic-gate		/* Got a gap; record it */				\
0Sstevel@tonic-gate		dprint(2, ("data_chunk: acking gap %x\n", tsn));	\
1932Svi117747		sctp_ack_add(&sctp->sctp_sack_info, tsn,		\
1932Svi117747		    &sctp->sctp_sack_gaps);				\
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;				\
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	errmp = NULL;
0Sstevel@tonic-gate	dmp = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dc = (sctp_data_hdr_t *)ch;
0Sstevel@tonic-gate	tsn = ntohl(dc->sdh_tsn);
0Sstevel@tonic-gate
1676Sjpk	dprint(3, ("sctp_data_chunk: mp=%p tsn=%x\n", (void *)mp, tsn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Check for duplicates */
0Sstevel@tonic-gate	if (SEQ_LT(tsn, sctp->sctp_ftsn)) {
0Sstevel@tonic-gate		dprint(4, ("sctp_data_chunk: dropping duplicate\n"));
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		sctp_add_dup(dc->sdh_tsn, dups);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_set_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
0Sstevel@tonic-gate			if (SEQ_GEQ(tsn, sp->begin) && SEQ_LEQ(tsn, sp->end)) {
0Sstevel@tonic-gate				dprint(4,
0Sstevel@tonic-gate				("sctp_data_chunk: dropping dup > cumtsn\n"));
0Sstevel@tonic-gate				sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate				sctp_add_dup(dc->sdh_tsn, dups);
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* We cannot deliver anything up now but we still need to handle it. */
0Sstevel@tonic-gate	if (SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInClosed);
0Sstevel@tonic-gate		can_deliver = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dlen = ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Check for buffer space */
0Sstevel@tonic-gate	if (sctp->sctp_rwnd - sctp->sctp_rxqueued < dlen) {
0Sstevel@tonic-gate		/* Drop and SACK, but don't advance the cumulative TSN. */
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		dprint(0, ("sctp_data_chunk: exceed rwnd %d rxqueued %d "
0Sstevel@tonic-gate			"ssn %d tsn %x\n", sctp->sctp_rwnd,
0Sstevel@tonic-gate			sctp->sctp_rxqueued, dc->sdh_ssn, ntohl(dc->sdh_tsn)));
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (ntohs(dc->sdh_sid) >= sctp->sctp_num_istr) {
0Sstevel@tonic-gate		uint16_t	inval_parm[2];
0Sstevel@tonic-gate
0Sstevel@tonic-gate		inval_parm[0] = dc->sdh_sid;
0Sstevel@tonic-gate		/* RESERVED to be ignored at the receiving end */
0Sstevel@tonic-gate		inval_parm[1] = 0;
0Sstevel@tonic-gate		/* ack and drop it */
0Sstevel@tonic-gate		errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID,
0Sstevel@tonic-gate		    (char *)inval_parm, sizeof (inval_parm));
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		if (errmp != NULL)
0Sstevel@tonic-gate			sctp_send_err(sctp, errmp, NULL);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ubit = SCTP_DATA_GET_UBIT(dc);
0Sstevel@tonic-gate	ASSERT(sctp->sctp_instr != NULL);
0Sstevel@tonic-gate	instr = &sctp->sctp_instr[ntohs(dc->sdh_sid)];
0Sstevel@tonic-gate	/* Initialize the stream, if not yet used */
0Sstevel@tonic-gate	if (instr->sctp == NULL)
0Sstevel@tonic-gate		instr->sctp = sctp;
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If we are getting low on buffers set trypartial to try
0Sstevel@tonic-gate	 * a partial delivery if we are reassembling a fragmented
0Sstevel@tonic-gate	 * message. Only do this if we can immediately deliver the
0Sstevel@tonic-gate	 * partially assembled message, and only partially deliver
0Sstevel@tonic-gate	 * one message at a time (i.e. messages cannot be intermixed
0Sstevel@tonic-gate	 * arriving at the upper layer). A simple way to enforce
0Sstevel@tonic-gate	 * this is to only try partial delivery if this TSN is
0Sstevel@tonic-gate	 * the next expected TSN. Partial Delivery not supported
0Sstevel@tonic-gate	 * for un-ordered message.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	isfrag = !(SCTP_DATA_GET_BBIT(dc) && SCTP_DATA_GET_EBIT(dc));
0Sstevel@tonic-gate	ssn = ntohs(dc->sdh_ssn);
0Sstevel@tonic-gate	if ((sctp->sctp_rwnd - sctp->sctp_rxqueued < SCTP_RECV_LOWATER) &&
0Sstevel@tonic-gate	    !ubit && isfrag && (tsn == sctp->sctp_ftsn)) {
0Sstevel@tonic-gate		trypartial = 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dmp = dupb(mp);
0Sstevel@tonic-gate	if (dmp == NULL) {
0Sstevel@tonic-gate		/* drop it and don't ack it, causing the peer to retransmit */
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	dmp->b_wptr = (uchar_t *)ch + ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp->sctp_rxqueued += dlen;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	oftsn = sctp->sctp_ftsn;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (isfrag) {
0Sstevel@tonic-gate		int error = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* fragmented data chunk */
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate		if (ubit) {
0Sstevel@tonic-gate			dmp = sctp_uodata_frag(sctp, dmp, &dc);
0Sstevel@tonic-gate#if	DEBUG
0Sstevel@tonic-gate			if (dmp != NULL) {
0Sstevel@tonic-gate				ASSERT(instr ==
0Sstevel@tonic-gate				    &sctp->sctp_instr[ntohs(dc->sdh_sid)]);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			dmp = sctp_data_frag(sctp, dmp, &dc, &error, instr,
0Sstevel@tonic-gate			    trypartial, &tpfinished);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (error != 0) {
0Sstevel@tonic-gate			sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate			if (error == 1) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * out of memory; don't ack it so
0Sstevel@tonic-gate				 * the peer retransmits
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			} else if (error == 2) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * fatal error (i.e. peer used different
0Sstevel@tonic-gate				 * ssn's for same fragmented data) --
0Sstevel@tonic-gate				 * the association has been aborted.
0Sstevel@tonic-gate				 * XXX need to return errval so state
0Sstevel@tonic-gate				 * machine can also abort processing.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				dprint(0, ("error 2: must not happen!\n"));
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (dmp == NULL) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * Can't process this data now, but the cumulative
0Sstevel@tonic-gate			 * TSN may be advanced, so do the checks at done.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (!ubit && !trypartial && ssn != instr->nextseq) {
0Sstevel@tonic-gate		/* Adjust rptr to point at the data chunk for compares */
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		dprint(2,
0Sstevel@tonic-gate		    ("data_chunk: inserted %x in pq (ssn %d expected %d)\n",
0Sstevel@tonic-gate		    ntohl(dc->sdh_tsn), (int)(ssn), (int)(instr->nextseq)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (instr->istr_msgs == NULL) {
0Sstevel@tonic-gate			instr->istr_msgs = dmp;
0Sstevel@tonic-gate			ASSERT(dmp->b_prev == NULL && dmp->b_next == NULL);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			mblk_t			*imblk = instr->istr_msgs;
0Sstevel@tonic-gate			sctp_data_hdr_t		*idc;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * XXXNeed to take sequence wraps into account,
0Sstevel@tonic-gate			 * ... and a more efficient insertion algo.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			for (;;) {
0Sstevel@tonic-gate				idc = (sctp_data_hdr_t *)imblk->b_rptr;
0Sstevel@tonic-gate				if (SSN_GT(ntohs(idc->sdh_ssn),
0Sstevel@tonic-gate					ntohs(dc->sdh_ssn))) {
0Sstevel@tonic-gate					if (instr->istr_msgs == imblk) {
0Sstevel@tonic-gate						instr->istr_msgs = dmp;
0Sstevel@tonic-gate						dmp->b_next = imblk;
0Sstevel@tonic-gate						imblk->b_prev = dmp;
0Sstevel@tonic-gate					} else {
0Sstevel@tonic-gate						ASSERT(imblk->b_prev != NULL);
0Sstevel@tonic-gate						imblk->b_prev->b_next = dmp;
0Sstevel@tonic-gate						dmp->b_prev = imblk->b_prev;
0Sstevel@tonic-gate						imblk->b_prev = dmp;
0Sstevel@tonic-gate						dmp->b_next = imblk;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (imblk->b_next == NULL) {
0Sstevel@tonic-gate					imblk->b_next = dmp;
0Sstevel@tonic-gate					dmp->b_prev = imblk;
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				imblk = imblk->b_next;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		(instr->istr_nmsgs)++;
0Sstevel@tonic-gate		(sctp->sctp_istr_nmsgs)++;
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Else we can deliver the data directly. Recalculate
0Sstevel@tonic-gate	 * dlen now since we may have reassembled data.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	dlen = dmp->b_wptr - (uchar_t *)dc - sizeof (*dc);
0Sstevel@tonic-gate	for (pmp = dmp->b_cont; pmp != NULL; pmp = pmp->b_cont)
0Sstevel@tonic-gate		dlen += pmp->b_wptr - pmp->b_rptr;
0Sstevel@tonic-gate	ASSERT(sctp->sctp_rxqueued >= dlen);
0Sstevel@tonic-gate	ASSERT(sctp->sctp_rwnd >= dlen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Deliver the message. */
0Sstevel@tonic-gate	sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (can_deliver) {
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)(dc + 1);
0Sstevel@tonic-gate		if (sctp_input_add_ancillary(sctp, &dmp, dc, fp, ipp) == 0) {
0Sstevel@tonic-gate			dprint(1, ("sctp_data_chunk: delivering %lu bytes\n",
0Sstevel@tonic-gate			    msgdsize(dmp)));
0Sstevel@tonic-gate			sctp->sctp_rwnd -= dlen;
0Sstevel@tonic-gate			new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd, dmp,
0Sstevel@tonic-gate			    tpfinished ? 0 : SCTP_PARTIAL_DATA);
0Sstevel@tonic-gate			if (new_rwnd > sctp->sctp_rwnd) {
0Sstevel@tonic-gate				sctp->sctp_rwnd = new_rwnd;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* Just free the message if we don't have memory. */
0Sstevel@tonic-gate			freemsg(dmp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* About to free the data */
0Sstevel@tonic-gate		freemsg(dmp);
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * data, now enqueued, may already have been processed and free'd
0Sstevel@tonic-gate	 * by the ULP (or we may have just freed it above, if we could not
0Sstevel@tonic-gate	 * deliver it), so we must not reference it (this is why we kept
0Sstevel@tonic-gate	 * the ssn and ubit above).
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (ubit != 0) {
0Sstevel@tonic-gate		BUMP_LOCAL(sctp->sctp_iudchunks);
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_idchunks);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there was a partial delivery and it has not finished,
0Sstevel@tonic-gate	 * don't pull anything from the pqueues.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (!tpfinished) {
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	instr->nextseq = ssn + 1;
0Sstevel@tonic-gate	/* Deliver any successive data chunks in the instr queue */
0Sstevel@tonic-gate	while (instr->istr_nmsgs > 0) {
0Sstevel@tonic-gate		dmp = (mblk_t *)instr->istr_msgs;
0Sstevel@tonic-gate		dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate		ssn = ntohs(dc->sdh_ssn);
0Sstevel@tonic-gate		/* Gap in the sequence */
0Sstevel@tonic-gate		if (ssn != instr->nextseq)
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* Else deliver the data */
0Sstevel@tonic-gate		(instr->istr_nmsgs)--;
0Sstevel@tonic-gate		(instr->nextseq)++;
0Sstevel@tonic-gate		(sctp->sctp_istr_nmsgs)--;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		instr->istr_msgs = instr->istr_msgs->b_next;
0Sstevel@tonic-gate		if (instr->istr_msgs != NULL)
0Sstevel@tonic-gate			instr->istr_msgs->b_prev = NULL;
0Sstevel@tonic-gate		dmp->b_next = dmp->b_prev = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		dprint(2, ("data_chunk: pulling %x from pq (ssn %d)\n",
0Sstevel@tonic-gate		    ntohl(dc->sdh_tsn), (int)ssn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * If this chunk was reassembled, each b_cont represents
0Sstevel@tonic-gate		 * another TSN; advance ftsn now.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
0Sstevel@tonic-gate		for (pmp = dmp->b_cont; pmp; pmp = pmp->b_cont)
0Sstevel@tonic-gate			dlen += pmp->b_wptr - pmp->b_rptr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		ASSERT(sctp->sctp_rxqueued >= dlen);
0Sstevel@tonic-gate		ASSERT(sctp->sctp_rwnd >= dlen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate		if (can_deliver) {
0Sstevel@tonic-gate			dmp->b_rptr = (uchar_t *)(dc + 1);
0Sstevel@tonic-gate			if (sctp_input_add_ancillary(sctp, &dmp, dc, fp,
0Sstevel@tonic-gate			    ipp) == 0) {
0Sstevel@tonic-gate				dprint(1, ("sctp_data_chunk: delivering %lu "
0Sstevel@tonic-gate				    "bytes\n", msgdsize(dmp)));
0Sstevel@tonic-gate				sctp->sctp_rwnd -= dlen;
0Sstevel@tonic-gate				new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd,
0Sstevel@tonic-gate				    dmp, tpfinished ? 0 : SCTP_PARTIAL_DATA);
0Sstevel@tonic-gate				if (new_rwnd > sctp->sctp_rwnd) {
0Sstevel@tonic-gate					sctp->sctp_rwnd = new_rwnd;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				freemsg(dmp);
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* About to free the data */
0Sstevel@tonic-gate			freemsg(dmp);
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatedone:
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there are gap reports pending, check if advancing
0Sstevel@tonic-gate	 * the ftsn here closes a gap. If so, we can advance
0Sstevel@tonic-gate	 * ftsn to the end of the set.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL &&
0Sstevel@tonic-gate	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
0Sstevel@tonic-gate		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If ftsn has moved forward, maybe we can remove gap reports.
0Sstevel@tonic-gate	 * NB: dmp may now be NULL, so don't dereference it here.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (oftsn != sctp->sctp_ftsn && sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate		dprint(2, ("data_chunk: removed acks before %x (num=%d)\n",
0Sstevel@tonic-gate		    sctp->sctp_ftsn - 1, sctp->sctp_sack_gaps));
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		ASSERT(sctp->sctp_ftsn != sctp->sctp_sack_info->begin);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate
0Sstevel@tonic-gate#undef	SCTP_ACK_IT
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_fill_sack(sctp_t *sctp, unsigned char *dst, int sacklen)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t *sch;
0Sstevel@tonic-gate	sctp_sack_chunk_t *sc;
0Sstevel@tonic-gate	sctp_sack_frag_t *sf;
0Sstevel@tonic-gate	uint16_t num_gaps = sctp->sctp_sack_gaps;
0Sstevel@tonic-gate	sctp_set_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Chunk hdr */
0Sstevel@tonic-gate	sch = (sctp_chunk_hdr_t *)dst;
0Sstevel@tonic-gate	sch->sch_id = CHUNK_SACK;
0Sstevel@tonic-gate	sch->sch_flags = 0;
0Sstevel@tonic-gate	sch->sch_len = htons(sacklen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* SACK chunk */
0Sstevel@tonic-gate	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sc = (sctp_sack_chunk_t *)(sch + 1);
0Sstevel@tonic-gate	sc->ssc_cumtsn = htonl(sctp->sctp_lastacked);
0Sstevel@tonic-gate	if (sctp->sctp_rxqueued < sctp->sctp_rwnd) {
0Sstevel@tonic-gate		sc->ssc_a_rwnd = htonl(sctp->sctp_rwnd - sctp->sctp_rxqueued);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sc->ssc_a_rwnd = 0;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sc->ssc_numfrags = htons(num_gaps);
0Sstevel@tonic-gate	sc->ssc_numdups = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* lay in gap reports */
0Sstevel@tonic-gate	sf = (sctp_sack_frag_t *)(sc + 1);
0Sstevel@tonic-gate	for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
0Sstevel@tonic-gate		uint16_t offset;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* start */
0Sstevel@tonic-gate		if (sp->begin > sctp->sctp_lastacked) {
0Sstevel@tonic-gate			offset = (uint16_t)(sp->begin - sctp->sctp_lastacked);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* sequence number wrap */
0Sstevel@tonic-gate			offset = (uint16_t)(UINT32_MAX - sctp->sctp_lastacked +
0Sstevel@tonic-gate			    sp->begin);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sf->ssf_start = htons(offset);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* end */
0Sstevel@tonic-gate		if (sp->end >= sp->begin) {
0Sstevel@tonic-gate			offset += (uint16_t)(sp->end - sp->begin);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* sequence number wrap */
0Sstevel@tonic-gate			offset += (uint16_t)(UINT32_MAX - sp->begin + sp->end);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sf->ssf_end = htons(offset);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sf++;
0Sstevel@tonic-gate		/* This is just for debugging (a la the following assertion) */
0Sstevel@tonic-gate		num_gaps--;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(num_gaps == 0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* If the SACK timer is running, stop it */
0Sstevel@tonic-gate	if (sctp->sctp_ack_timer_running) {
0Sstevel@tonic-gate		sctp_timer_stop(sctp->sctp_ack_mp);
0Sstevel@tonic-gate		sctp->sctp_ack_timer_running = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_obchunks);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatemblk_t *
0Sstevel@tonic-gatesctp_make_sack(sctp_t *sctp, sctp_faddr_t *sendto, mblk_t *dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *smp;
0Sstevel@tonic-gate	size_t slen;
0Sstevel@tonic-gate	sctp_chunk_hdr_t *sch;
0Sstevel@tonic-gate	sctp_sack_chunk_t *sc;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_force_sack) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 0;
0Sstevel@tonic-gate		goto checks_done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_state == SCTPS_ESTABLISHED) {
0Sstevel@tonic-gate		if (sctp->sctp_sack_toggle < 2) {
0Sstevel@tonic-gate			/* no need to SACK right now */
0Sstevel@tonic-gate			dprint(2, ("sctp_make_sack: %p no sack (toggle)\n",
1676Sjpk			    (void *)sctp));
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate		} else if (sctp->sctp_sack_toggle >= 2) {
0Sstevel@tonic-gate			sctp->sctp_sack_toggle = 0;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_ftsn == sctp->sctp_lastacked + 1) {
1676Sjpk		dprint(2, ("sctp_make_sack: %p no sack (already)\n",
1676Sjpk		    (void *)sctp));
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatechecks_done:
0Sstevel@tonic-gate	dprint(2, ("sctp_make_sack: acking %x\n", sctp->sctp_ftsn - 1));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	slen = sizeof (*sch) + sizeof (*sc) +
0Sstevel@tonic-gate	    (sizeof (sctp_sack_frag_t) * sctp->sctp_sack_gaps);
0Sstevel@tonic-gate	smp = sctp_make_mp(sctp, sendto, slen);
0Sstevel@tonic-gate	if (smp == NULL) {
1735Skcpoon		SCTP_KSTAT(sctp_send_sack_failed);
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sch = (sctp_chunk_hdr_t *)smp->b_wptr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_fill_sack(sctp, smp->b_wptr, slen);
0Sstevel@tonic-gate	smp->b_wptr += slen;
0Sstevel@tonic-gate	if (dups) {
0Sstevel@tonic-gate		sc = (sctp_sack_chunk_t *)(sch + 1);
0Sstevel@tonic-gate		sc->ssc_numdups = htons((dups->b_wptr - dups->b_rptr)
0Sstevel@tonic-gate		    / sizeof (uint32_t));
0Sstevel@tonic-gate		sch->sch_len = htons(slen + (dups->b_wptr - dups->b_rptr));
0Sstevel@tonic-gate		smp->b_cont = dups;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (smp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_sack(sctp_t *sctp, mblk_t *dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *smp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* If we are shutting down, let send_shutdown() bundle the SACK */
0Sstevel@tonic-gate	if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate		sctp_send_shutdown(sctp, 0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(sctp->sctp_lastdata != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if ((smp = sctp_make_sack(sctp, sctp->sctp_lastdata, dups)) == NULL) {
0Sstevel@tonic-gate		/* The caller of sctp_sack() will not free the dups mblk. */
0Sstevel@tonic-gate		if (dups != NULL)
0Sstevel@tonic-gate			freeb(dups);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_set_iplen(sctp, smp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dprint(2, ("sctp_sack: sending to %p %x:%x:%x:%x\n",
1676Sjpk	    (void *)sctp->sctp_lastdata,
1676Sjpk	    SCTP_PRINTADDR(sctp->sctp_lastdata->faddr)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp->sctp_active = lbolt64;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_MIB(&sctp_mib, sctpOutAck);
0Sstevel@tonic-gate	sctp_add_sendq(sctp, smp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * This is called if we have a message that was partially sent and is
0Sstevel@tonic-gate * abandoned. The cum TSN will be the last chunk sent for this message,
0Sstevel@tonic-gate * subsequent chunks will be marked ABANDONED. We send a Forward TSN
0Sstevel@tonic-gate * chunk in this case with the TSN of the last sent chunk so that the
0Sstevel@tonic-gate * peer can clean up its fragment list for this message. This message
0Sstevel@tonic-gate * will be removed from the transmit list when the peer sends a SACK
0Sstevel@tonic-gate * back.
0Sstevel@tonic-gate */
0Sstevel@tonic-gateint
0Sstevel@tonic-gatesctp_check_abandoned_msg(sctp_t *sctp, mblk_t *meta)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_data_hdr_t	*dh;
0Sstevel@tonic-gate	mblk_t		*nmp;
0Sstevel@tonic-gate	mblk_t		*head;
0Sstevel@tonic-gate	int32_t		unsent = 0;
0Sstevel@tonic-gate	mblk_t		*mp1 = meta->b_cont;
0Sstevel@tonic-gate	uint32_t	adv_pap = sctp->sctp_adv_pap;
0Sstevel@tonic-gate	sctp_faddr_t	*fp = sctp->sctp_current;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate	if (SEQ_GEQ(sctp->sctp_lastack_rxd, ntohl(dh->sdh_tsn))) {
0Sstevel@tonic-gate		sctp_ftsn_set_t	*sets = NULL;
0Sstevel@tonic-gate		uint_t		nsets = 0;
0Sstevel@tonic-gate		uint32_t	seglen = sizeof (uint32_t);
0Sstevel@tonic-gate		boolean_t	ubit = SCTP_DATA_GET_UBIT(dh);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		while (mp1->b_next != NULL && SCTP_CHUNK_ISSENT(mp1->b_next))
0Sstevel@tonic-gate			mp1 = mp1->b_next;
0Sstevel@tonic-gate		dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate		sctp->sctp_adv_pap = ntohl(dh->sdh_tsn);
0Sstevel@tonic-gate		if (!ubit &&
0Sstevel@tonic-gate		    !sctp_add_ftsn_set(&sets, fp, meta, &nsets, &seglen)) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		nmp = sctp_make_ftsn_chunk(sctp, fp, sets, nsets, seglen);
0Sstevel@tonic-gate		sctp_free_ftsn_set(sets);
0Sstevel@tonic-gate		if (nmp == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
252Svi117747		head = sctp_add_proto_hdr(sctp, fp, nmp, 0, NULL);
0Sstevel@tonic-gate		if (head == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			freemsg(nmp);
1735Skcpoon			SCTP_KSTAT(sctp_send_ftsn_failed);
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		SCTP_MSG_SET_ABANDONED(meta);
0Sstevel@tonic-gate		sctp_set_iplen(sctp, head);
0Sstevel@tonic-gate		sctp_add_sendq(sctp, head);
0Sstevel@tonic-gate		if (!fp->timer_running)
0Sstevel@tonic-gate			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate		mp1 = mp1->b_next;
0Sstevel@tonic-gate		while (mp1 != NULL) {
0Sstevel@tonic-gate			ASSERT(!SCTP_CHUNK_ISSENT(mp1));
0Sstevel@tonic-gate			ASSERT(!SCTP_CHUNK_ABANDONED(mp1));
0Sstevel@tonic-gate			SCTP_ABANDON_CHUNK(mp1);
0Sstevel@tonic-gate			dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate			unsent += ntohs(dh->sdh_len) - sizeof (*dh);
0Sstevel@tonic-gate			mp1 = mp1->b_next;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ASSERT(sctp->sctp_unsent >= unsent);
0Sstevel@tonic-gate		sctp->sctp_unsent -= unsent;
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Update ULP the amount of queued data, which is
0Sstevel@tonic-gate		 * sent-unack'ed + unsent.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (!SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate			sctp->sctp_ulp_xmitted(sctp->sctp_ulpd,
0Sstevel@tonic-gate			    sctp->sctp_unacked + sctp->sctp_unsent);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (-1);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gateuint32_t
0Sstevel@tonic-gatesctp_cumack(sctp_t *sctp, uint32_t tsn, mblk_t **first_unacked)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *ump, *nump, *mp = NULL;
0Sstevel@tonic-gate	uint16_t chunklen;
0Sstevel@tonic-gate	uint32_t xtsn;
0Sstevel@tonic-gate	sctp_faddr_t *fp;
0Sstevel@tonic-gate	sctp_data_hdr_t *sdc;
0Sstevel@tonic-gate	uint32_t cumack_forward = 0;
0Sstevel@tonic-gate	sctp_msg_hdr_t	*mhdr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ump = sctp->sctp_xmit_head;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Free messages only when they're completely acked.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	while (ump != NULL) {
0Sstevel@tonic-gate		mhdr = (sctp_msg_hdr_t *)ump->b_rptr;
0Sstevel@tonic-gate		for (mp = ump->b_cont; mp != NULL; mp = mp->b_next) {
0Sstevel@tonic-gate			if (SCTP_CHUNK_ABANDONED(mp)) {
0Sstevel@tonic-gate				ASSERT(SCTP_IS_MSG_ABANDONED(ump));
0Sstevel@tonic-gate				mp = NULL;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * We check for abandoned message if we are PR-SCTP
0Sstevel@tonic-gate			 * aware, if this is not the first chunk in the
0Sstevel@tonic-gate			 * message (b_cont) and if the message is marked
0Sstevel@tonic-gate			 * abandoned.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISSENT(mp)) {
0Sstevel@tonic-gate				if (sctp->sctp_prsctp_aware &&
0Sstevel@tonic-gate				    mp != ump->b_cont &&
0Sstevel@tonic-gate				    (SCTP_IS_MSG_ABANDONED(ump) ||
0Sstevel@tonic-gate				    SCTP_MSG_TO_BE_ABANDONED(ump, mhdr,
0Sstevel@tonic-gate				    sctp))) {
0Sstevel@tonic-gate					(void) sctp_check_abandoned_msg(sctp,
0Sstevel@tonic-gate					    ump);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				goto cum_ack_done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate			if (SEQ_GEQ(sctp->sctp_lastack_rxd, xtsn))
0Sstevel@tonic-gate				continue;
0Sstevel@tonic-gate			if (SEQ_GEQ(tsn, xtsn)) {
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (sctp->sctp_out_time != 0 &&
0Sstevel@tonic-gate				    xtsn == sctp->sctp_rtt_tsn) {
0Sstevel@tonic-gate					/* Got a new RTT measurement */
0Sstevel@tonic-gate					sctp_update_rtt(sctp, fp,
0Sstevel@tonic-gate					    lbolt64 - sctp->sctp_out_time);
0Sstevel@tonic-gate					sctp->sctp_out_time = 0;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (SCTP_CHUNK_ISACKED(mp))
0Sstevel@tonic-gate					continue;
1735Skcpoon				SCTP_CHUNK_SET_SACKCNT(mp, 0);
0Sstevel@tonic-gate				SCTP_CHUNK_ACKED(mp);
0Sstevel@tonic-gate				ASSERT(fp->suna >= chunklen);
0Sstevel@tonic-gate				fp->suna -= chunklen;
0Sstevel@tonic-gate				fp->acked += chunklen;
0Sstevel@tonic-gate				cumack_forward += chunklen;
0Sstevel@tonic-gate				ASSERT(sctp->sctp_unacked >=
0Sstevel@tonic-gate				    (chunklen - sizeof (*sdc)));
0Sstevel@tonic-gate				sctp->sctp_unacked -=
0Sstevel@tonic-gate				    (chunklen - sizeof (*sdc));
0Sstevel@tonic-gate				if (fp->suna == 0) {
0Sstevel@tonic-gate					/* all outstanding data acked */
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_STOP(fp);
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				goto cum_ack_done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		nump = ump->b_next;
0Sstevel@tonic-gate		if (nump != NULL)
0Sstevel@tonic-gate			nump->b_prev = NULL;
0Sstevel@tonic-gate		if (ump == sctp->sctp_xmit_tail)
0Sstevel@tonic-gate			sctp->sctp_xmit_tail = nump;
0Sstevel@tonic-gate		if (SCTP_IS_MSG_ABANDONED(ump)) {
0Sstevel@tonic-gate			BUMP_LOCAL(sctp->sctp_prsctpdrop);
0Sstevel@tonic-gate			ump->b_next = NULL;
0Sstevel@tonic-gate			sctp_sendfail_event(sctp, ump, 0, B_TRUE);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			sctp_free_msg(ump);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sctp->sctp_xmit_head = ump = nump;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gatecum_ack_done:
0Sstevel@tonic-gate	*first_unacked = mp;
0Sstevel@tonic-gate	if (cumack_forward > 0) {
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInAck);
0Sstevel@tonic-gate		if (SEQ_GT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn)) {
0Sstevel@tonic-gate			sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Update ULP the amount of queued data, which is
0Sstevel@tonic-gate		 * sent-unack'ed + unsent.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (!SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate			sctp->sctp_ulp_xmitted(sctp->sctp_ulpd,
0Sstevel@tonic-gate			    sctp->sctp_unacked + sctp->sctp_unsent);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* Time to send a shutdown? */
0Sstevel@tonic-gate		if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
0Sstevel@tonic-gate			sctp_send_shutdown(sctp, 0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sctp->sctp_xmit_unacked = mp;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* dup ack */
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInDupAck);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sctp->sctp_lastack_rxd = tsn;
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_adv_pap, sctp->sctp_lastack_rxd))
0Sstevel@tonic-gate		sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
0Sstevel@tonic-gate	ASSERT(sctp->sctp_xmit_head || sctp->sctp_unacked == 0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (cumack_forward);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_set_frwnd(sctp_t *sctp, uint32_t frwnd)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	uint32_t orwnd;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_unacked > frwnd) {
0Sstevel@tonic-gate		sctp->sctp_frwnd = 0;
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	orwnd = sctp->sctp_frwnd;
0Sstevel@tonic-gate	sctp->sctp_frwnd = frwnd - sctp->sctp_unacked;
0Sstevel@tonic-gate	if (orwnd < sctp->sctp_frwnd) {
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * For un-ordered messages.
0Sstevel@tonic-gate * Walk the sctp->sctp_uo_frag list and remove any fragments with TSN
0Sstevel@tonic-gate * less than/equal to ftsn. Fragments for un-ordered messages are
0Sstevel@tonic-gate * strictly in sequence (w.r.t TSN).
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_ftsn_check_uo_frag(sctp_t *sctp, uint32_t ftsn)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*hmp_next;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	int		dlen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	hmp = sctp->sctp_uo_frags;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		hmp_next = hmp->b_next;
0Sstevel@tonic-gate		dc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		if (SEQ_GT(ntohl(dc->sdh_tsn), ftsn))
0Sstevel@tonic-gate			return (dlen);
0Sstevel@tonic-gate		sctp->sctp_uo_frags = hmp_next;
0Sstevel@tonic-gate		if (hmp_next != NULL)
0Sstevel@tonic-gate			hmp_next->b_prev = NULL;
0Sstevel@tonic-gate		hmp->b_next = NULL;
0Sstevel@tonic-gate		dlen += ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate		freeb(hmp);
0Sstevel@tonic-gate		hmp = hmp_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (dlen);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * For ordered messages.
0Sstevel@tonic-gate * Check for existing fragments for an sid-ssn pair reported as abandoned,
0Sstevel@tonic-gate * hence will not receive, in the Forward TSN. If there are fragments, then
0Sstevel@tonic-gate * we just nuke them. If and when Partial Delivery API is supported, we
0Sstevel@tonic-gate * would need to send a notification to the upper layer about this.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_ftsn_check_frag(sctp_t *sctp, uint16_t ssn, sctp_instr_t *sip)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_reass_t	*srp;
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*dmp;
0Sstevel@tonic-gate	mblk_t		*hmp_next;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	int		dlen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	hmp = sip->istr_reass;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		hmp_next = hmp->b_next;
0Sstevel@tonic-gate		srp = (sctp_reass_t *)DB_BASE(hmp);
0Sstevel@tonic-gate		if (SSN_GT(srp->ssn, ssn))
0Sstevel@tonic-gate			return (dlen);
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * If we had sent part of this message up, send a partial
0Sstevel@tonic-gate		 * delivery event. Since this is ordered delivery, we should
0Sstevel@tonic-gate		 * have sent partial message only for the next in sequence,
0Sstevel@tonic-gate		 * hence the ASSERT. See comments in sctp_data_chunk() for
0Sstevel@tonic-gate		 * trypartial.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (srp->partial_delivered) {
0Sstevel@tonic-gate			ASSERT(sip->nextseq == srp->ssn);
0Sstevel@tonic-gate			sctp_partial_delivery_event(sctp);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* Take it out of the reass queue */
0Sstevel@tonic-gate		sip->istr_reass = hmp_next;
0Sstevel@tonic-gate		if (hmp_next != NULL)
0Sstevel@tonic-gate			hmp_next->b_prev = NULL;
0Sstevel@tonic-gate		hmp->b_next = NULL;
0Sstevel@tonic-gate		ASSERT(hmp->b_prev == NULL);
0Sstevel@tonic-gate		dmp = hmp;
0Sstevel@tonic-gate		if (DB_TYPE(hmp) == M_CTL) {
0Sstevel@tonic-gate			dmp = hmp->b_cont;
0Sstevel@tonic-gate			hmp->b_cont = NULL;
0Sstevel@tonic-gate			freeb(hmp);
0Sstevel@tonic-gate			hmp = dmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		while (dmp != NULL) {
0Sstevel@tonic-gate			dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate			dlen += ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate			dmp = dmp->b_cont;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		freemsg(hmp);
0Sstevel@tonic-gate		hmp = hmp_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (dlen);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Update sctp_ftsn to the cumulative TSN from the Forward TSN chunk. Remove
0Sstevel@tonic-gate * any SACK gaps less than the newly updated sctp_ftsn. Walk through the
0Sstevel@tonic-gate * sid-ssn pair in the Forward TSN and for each, clean the fragment list
0Sstevel@tonic-gate * for this pair, if needed, and check if we can deliver subsequent
0Sstevel@tonic-gate * messages, if any, from the instream queue (that were waiting for this
0Sstevel@tonic-gate * sid-ssn message to show up). Once we are done try to update the SACK
0Sstevel@tonic-gate * info. We could get a duplicate Forward TSN, in which case just send
0Sstevel@tonic-gate * a SACK. If any of the sid values in the the Forward TSN is invalid,
0Sstevel@tonic-gate * send back an "Invalid Stream Identifier" error and continue processing
0Sstevel@tonic-gate * the rest.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_process_forward_tsn(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp,
0Sstevel@tonic-gate    ip6_pkt_t *ipp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	uint32_t	*ftsn = (uint32_t *)(ch + 1);
0Sstevel@tonic-gate	ftsn_entry_t	*ftsn_entry;
0Sstevel@tonic-gate	sctp_instr_t	*instr;
0Sstevel@tonic-gate	boolean_t	can_deliver = B_TRUE;
0Sstevel@tonic-gate	size_t		dlen;
0Sstevel@tonic-gate	int		flen;
0Sstevel@tonic-gate	mblk_t		*dmp;
0Sstevel@tonic-gate	mblk_t		*pmp;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	ssize_t		remaining;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*ftsn = ntohl(*ftsn);
0Sstevel@tonic-gate	remaining =  ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*ftsn);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInClosed);
0Sstevel@tonic-gate		can_deliver = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * un-ordered messages don't have SID-SSN pair entries, we check
0Sstevel@tonic-gate	 * for any fragments (for un-ordered message) to be discarded using
0Sstevel@tonic-gate	 * the cumulative FTSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	flen = sctp_ftsn_check_uo_frag(sctp, *ftsn);
0Sstevel@tonic-gate	if (flen > 0) {
0Sstevel@tonic-gate		ASSERT(sctp->sctp_rxqueued >= flen);
0Sstevel@tonic-gate		sctp->sctp_rxqueued -= flen;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ftsn_entry = (ftsn_entry_t *)(ftsn + 1);
0Sstevel@tonic-gate	while (remaining >= sizeof (*ftsn_entry)) {
0Sstevel@tonic-gate		ftsn_entry->ftsn_sid = ntohs(ftsn_entry->ftsn_sid);
0Sstevel@tonic-gate		ftsn_entry->ftsn_ssn = ntohs(ftsn_entry->ftsn_ssn);
0Sstevel@tonic-gate		if (ftsn_entry->ftsn_sid >= sctp->sctp_num_istr) {
0Sstevel@tonic-gate			uint16_t	inval_parm[2];
0Sstevel@tonic-gate			mblk_t		*errmp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			inval_parm[0] = htons(ftsn_entry->ftsn_sid);
0Sstevel@tonic-gate			/* RESERVED to be ignored at the receiving end */
0Sstevel@tonic-gate			inval_parm[1] = 0;
0Sstevel@tonic-gate			errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID,
0Sstevel@tonic-gate			    (char *)inval_parm, sizeof (inval_parm));
0Sstevel@tonic-gate			if (errmp != NULL)
0Sstevel@tonic-gate				sctp_send_err(sctp, errmp, NULL);
0Sstevel@tonic-gate			ftsn_entry++;
0Sstevel@tonic-gate			remaining -= sizeof (*ftsn_entry);
0Sstevel@tonic-gate			continue;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		instr = &sctp->sctp_instr[ftsn_entry->ftsn_sid];
0Sstevel@tonic-gate		flen = sctp_ftsn_check_frag(sctp, ftsn_entry->ftsn_ssn, instr);
0Sstevel@tonic-gate		/* Indicates frags were nuked, update rxqueued */
0Sstevel@tonic-gate		if (flen > 0) {
0Sstevel@tonic-gate			ASSERT(sctp->sctp_rxqueued >= flen);
0Sstevel@tonic-gate			sctp->sctp_rxqueued -= flen;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * It is possible to receive an FTSN chunk with SSN smaller
0Sstevel@tonic-gate		 * than then nextseq if this chunk is a retransmission because
0Sstevel@tonic-gate		 * of incomplete processing when it was first processed.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (SSN_GE(ftsn_entry->ftsn_ssn, instr->nextseq))
0Sstevel@tonic-gate			instr->nextseq = ftsn_entry->ftsn_ssn + 1;
0Sstevel@tonic-gate		while (instr->istr_nmsgs > 0) {
0Sstevel@tonic-gate			mblk_t	*next;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			dmp = (mblk_t *)instr->istr_msgs;
0Sstevel@tonic-gate			dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate			if (ntohs(dc->sdh_ssn) != instr->nextseq)
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			next = dmp->b_next;
0Sstevel@tonic-gate			dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
0Sstevel@tonic-gate			for (pmp = dmp->b_cont; pmp != NULL;
0Sstevel@tonic-gate			    pmp = pmp->b_cont) {
0Sstevel@tonic-gate				dlen += pmp->b_wptr - pmp->b_rptr;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (can_deliver) {
0Sstevel@tonic-gate				int32_t	nrwnd;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				dmp->b_rptr = (uchar_t *)(dc + 1);
0Sstevel@tonic-gate				dmp->b_next = NULL;
0Sstevel@tonic-gate				ASSERT(dmp->b_prev == NULL);
0Sstevel@tonic-gate				if (sctp_input_add_ancillary(sctp,
0Sstevel@tonic-gate				    &dmp, dc, fp, ipp) == 0) {
0Sstevel@tonic-gate					sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate					sctp->sctp_rwnd -= dlen;
0Sstevel@tonic-gate					nrwnd = sctp->sctp_ulp_recv(
0Sstevel@tonic-gate					    sctp->sctp_ulpd, dmp, 0);
0Sstevel@tonic-gate					if (nrwnd > sctp->sctp_rwnd)
0Sstevel@tonic-gate						sctp->sctp_rwnd = nrwnd;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * We will resume processing when
0Sstevel@tonic-gate					 * the FTSN chunk is re-xmitted.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate					dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate					dmp->b_next = next;
0Sstevel@tonic-gate					dprint(0,
0Sstevel@tonic-gate					    ("FTSN dequeuing %u failed\n",
0Sstevel@tonic-gate					    ntohs(dc->sdh_ssn)));
0Sstevel@tonic-gate					return;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate				ASSERT(dmp->b_prev == NULL);
0Sstevel@tonic-gate				dmp->b_next = NULL;
0Sstevel@tonic-gate				freemsg(dmp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			instr->istr_nmsgs--;
0Sstevel@tonic-gate			instr->nextseq++;
0Sstevel@tonic-gate			sctp->sctp_istr_nmsgs--;
0Sstevel@tonic-gate			if (next != NULL)
0Sstevel@tonic-gate				next->b_prev = NULL;
0Sstevel@tonic-gate			instr->istr_msgs = next;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ftsn_entry++;
0Sstevel@tonic-gate		remaining -= sizeof (*ftsn_entry);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Duplicate FTSN */
0Sstevel@tonic-gate	if (*ftsn <= (sctp->sctp_ftsn - 1)) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Advance cum TSN to that reported in the Forward TSN chunk */
0Sstevel@tonic-gate	sctp->sctp_ftsn = *ftsn + 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Remove all the SACK gaps before the new cum TSN */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there are gap reports pending, check if advancing
0Sstevel@tonic-gate	 * the ftsn here closes a gap. If so, we can advance
0Sstevel@tonic-gate	 * ftsn to the end of the set.
0Sstevel@tonic-gate	 * If ftsn has moved forward, maybe we can remove gap reports.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL &&
0Sstevel@tonic-gate	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
0Sstevel@tonic-gate		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * When we have processed a SACK we check to see if we can advance the
0Sstevel@tonic-gate * cumulative TSN if there are abandoned chunks immediately following
0Sstevel@tonic-gate * the updated cumulative TSN. If there are, we attempt to send a
0Sstevel@tonic-gate * Forward TSN chunk.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_check_abandoned_data(sctp_t *sctp, sctp_faddr_t *fp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*meta = sctp->sctp_xmit_head;
0Sstevel@tonic-gate	mblk_t		*mp;
0Sstevel@tonic-gate	mblk_t		*nmp;
0Sstevel@tonic-gate	uint32_t	seglen;
0Sstevel@tonic-gate	uint32_t	adv_pap = sctp->sctp_adv_pap;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We only check in the first meta since otherwise we can't
0Sstevel@tonic-gate	 * advance the cumulative ack point. We just look for chunks
0Sstevel@tonic-gate	 * marked for retransmission, else we might prematurely
0Sstevel@tonic-gate	 * send an FTSN for a sent, but unacked, chunk.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	for (mp = meta->b_cont; mp != NULL; mp = mp->b_next) {
0Sstevel@tonic-gate		if (!SCTP_CHUNK_ISSENT(mp))
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		if (SCTP_CHUNK_WANT_REXMIT(mp))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (mp == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	sctp_check_adv_ack_pt(sctp, meta, mp);
0Sstevel@tonic-gate	if (SEQ_GT(sctp->sctp_adv_pap, adv_pap)) {
0Sstevel@tonic-gate		sctp_make_ftsns(sctp, meta, mp, &nmp, fp, &seglen);
0Sstevel@tonic-gate		if (nmp == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			if (!fp->timer_running)
0Sstevel@tonic-gate				SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sctp_set_iplen(sctp, nmp);
0Sstevel@tonic-gate		sctp_add_sendq(sctp, nmp);
0Sstevel@tonic-gate		if (!fp->timer_running)
0Sstevel@tonic-gate			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
852Svi117747/*
852Svi117747 * The processing here follows the same logic in sctp_got_sack(), the reason
852Svi117747 * we do this separately is because, usually, gap blocks are ordered and
852Svi117747 * we can process it in sctp_got_sack(). However if they aren't we would
852Svi117747 * need to do some additional non-optimal stuff when we start processing the
852Svi117747 * unordered gaps. To that effect sctp_got_sack() does the processing in the
852Svi117747 * simple case and this does the same in the more involved case.
852Svi117747 */
852Svi117747static uint32_t
852Svi117747sctp_process_uo_gaps(sctp_t *sctp, uint32_t ctsn, sctp_sack_frag_t *ssf,
852Svi117747    int num_gaps, mblk_t *umphead, mblk_t *mphead, int *trysend,
852Svi117747    boolean_t *fast_recovery, uint32_t fr_xtsn)
852Svi117747{
852Svi117747	uint32_t		xtsn;
852Svi117747	uint32_t		gapstart = 0;
852Svi117747	uint32_t		gapend = 0;
852Svi117747	int			gapcnt;
852Svi117747	uint16_t		chunklen;
852Svi117747	sctp_data_hdr_t		*sdc;
852Svi117747	int			gstart;
852Svi117747	mblk_t			*ump = umphead;
852Svi117747	mblk_t			*mp = mphead;
852Svi117747	sctp_faddr_t		*fp;
852Svi117747	uint32_t		acked = 0;
852Svi117747
852Svi117747	/*
852Svi117747	 * gstart tracks the last (in the order of TSN) gapstart that
852Svi117747	 * we process in this SACK gaps walk.
852Svi117747	 */
852Svi117747	gstart = ctsn;
852Svi117747
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	for (gapcnt = 0; gapcnt < num_gaps; gapcnt++, ssf++) {
852Svi117747		if (gapstart != 0) {
852Svi117747			/*
852Svi117747			 * If we have reached the end of the transmit list or
852Svi117747			 * hit an unsent chunk or encountered an unordered gap
852Svi117747			 * block start from the ctsn again.
852Svi117747			 */
852Svi117747			if (ump == NULL || !SCTP_CHUNK_ISSENT(mp) ||
852Svi117747			    SEQ_LT(ctsn + ntohs(ssf->ssf_start), xtsn)) {
852Svi117747				ump = umphead;
852Svi117747				mp = mphead;
852Svi117747				sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747				xtsn = ntohl(sdc->sdh_tsn);
852Svi117747			}
852Svi117747		}
852Svi117747
852Svi117747		gapstart = ctsn + ntohs(ssf->ssf_start);
852Svi117747		gapend = ctsn + ntohs(ssf->ssf_end);
852Svi117747
852Svi117747		/* SACK for TSN we have not sent - ABORT */
852Svi117747		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
852Svi117747		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
852Svi117747			BUMP_MIB(&sctp_mib, sctpInAckUnsent);
852Svi117747			*trysend = -1;
852Svi117747			return (acked);
852Svi117747		} else if (SEQ_LT(gapend, gapstart)) {
852Svi117747			break;
852Svi117747		}
852Svi117747		/*
852Svi117747		 * The xtsn can be the TSN processed for the last gap
852Svi117747		 * (gapend) or it could be the cumulative TSN. We continue
852Svi117747		 * with the last xtsn as long as the gaps are ordered, when
852Svi117747		 * we hit an unordered gap, we re-start from the cumulative
852Svi117747		 * TSN. For the first gap it is always the cumulative TSN.
852Svi117747		 */
852Svi117747		while (xtsn != gapstart) {
852Svi117747			/*
852Svi117747			 * We can't reliably check for reneged chunks
852Svi117747			 * when walking the unordered list, so we don't.
852Svi117747			 * In case the peer reneges then we will end up
852Svi117747			 * sending the reneged chunk via timeout.
852Svi117747			 */
852Svi117747			mp = mp->b_next;
852Svi117747			if (mp == NULL) {
852Svi117747				ump = ump->b_next;
852Svi117747				/*
852Svi117747				 * ump can't be NULL because of the sanity
852Svi117747				 * check above.
852Svi117747				 */
852Svi117747				ASSERT(ump != NULL);
852Svi117747				mp = ump->b_cont;
852Svi117747			}
852Svi117747			/*
852Svi117747			 * mp can't be unsent because of the sanity check
852Svi117747			 * above.
852Svi117747			 */
852Svi117747			ASSERT(SCTP_CHUNK_ISSENT(mp));
852Svi117747			sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747			xtsn = ntohl(sdc->sdh_tsn);
852Svi117747		}
852Svi117747		/*
852Svi117747		 * Now that we have found the chunk with TSN == 'gapstart',
852Svi117747		 * let's walk till we hit the chunk with TSN == 'gapend'.
852Svi117747		 * All intermediate chunks will be marked ACKED, if they
852Svi117747		 * haven't already been.
852Svi117747		 */
852Svi117747		while (SEQ_LEQ(xtsn, gapend)) {
852Svi117747			/*
852Svi117747			 * SACKed
852Svi117747			 */
852Svi117747			SCTP_CHUNK_SET_SACKCNT(mp, 0);
852Svi117747			if (!SCTP_CHUNK_ISACKED(mp)) {
852Svi117747				SCTP_CHUNK_ACKED(mp);
852Svi117747
852Svi117747				fp = SCTP_CHUNK_DEST(mp);
852Svi117747				chunklen = ntohs(sdc->sdh_len);
852Svi117747				ASSERT(fp->suna >= chunklen);
852Svi117747				fp->suna -= chunklen;
852Svi117747				if (fp->suna == 0) {
852Svi117747					/* All outstanding data acked. */
852Svi117747					fp->pba = 0;
852Svi117747					SCTP_FADDR_TIMER_STOP(fp);
852Svi117747				}
852Svi117747				fp->acked += chunklen;
852Svi117747				acked += chunklen;
852Svi117747				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
852Svi117747				ASSERT(sctp->sctp_unacked >= 0);
852Svi117747			}
852Svi117747			/*
852Svi117747			 * Move to the next message in the transmit list
852Svi117747			 * if we are done with all the chunks from the current
852Svi117747			 * message. Note, it is possible to hit the end of the
852Svi117747			 * transmit list here, i.e. if we have already completed
852Svi117747			 * processing the gap block.
852Svi117747			 */
852Svi117747			mp = mp->b_next;
852Svi117747			if (mp == NULL) {
852Svi117747				ump = ump->b_next;
852Svi117747				if (ump == NULL) {
852Svi117747					ASSERT(xtsn == gapend);
852Svi117747					break;
852Svi117747				}
852Svi117747				mp = ump->b_cont;
852Svi117747			}
852Svi117747			/*
852Svi117747			 * Likewise, we can hit an unsent chunk once we have
852Svi117747			 * completed processing the gap block.
852Svi117747			 */
852Svi117747			if (!SCTP_CHUNK_ISSENT(mp)) {
852Svi117747				ASSERT(xtsn == gapend);
852Svi117747				break;
852Svi117747			}
852Svi117747			sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747			xtsn = ntohl(sdc->sdh_tsn);
852Svi117747		}
852Svi117747		/*
852Svi117747		 * We keep track of the last gap we successfully processed
852Svi117747		 * so that we can terminate the walk below for incrementing
852Svi117747		 * the SACK count.
852Svi117747		 */
852Svi117747		if (SEQ_LT(gstart, gapstart))
852Svi117747			gstart = gapstart;
852Svi117747	}
852Svi117747	/*
852Svi117747	 * Check if have incremented the SACK count for all unacked TSNs in
852Svi117747	 * sctp_got_sack(), if so we are done.
852Svi117747	 */
852Svi117747	if (SEQ_LEQ(gstart, fr_xtsn))
852Svi117747		return (acked);
852Svi117747
852Svi117747	ump = umphead;
852Svi117747	mp = mphead;
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	while (SEQ_LT(xtsn, gstart)) {
852Svi117747		/*
852Svi117747		 * We have incremented SACK count for TSNs less than fr_tsn
852Svi117747		 * in sctp_got_sack(), so don't increment them again here.
852Svi117747		 */
852Svi117747		if (SEQ_GT(xtsn, fr_xtsn) && !SCTP_CHUNK_ISACKED(mp)) {
852Svi117747			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
852Svi117747			if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) {
852Svi117747				SCTP_CHUNK_REXMIT(mp);
852Svi117747				sctp->sctp_chk_fast_rexmit = B_TRUE;
852Svi117747				*trysend = 1;
852Svi117747				if (!*fast_recovery) {
852Svi117747					/*
852Svi117747					 * Entering fast recovery.
852Svi117747					 */
852Svi117747					fp = SCTP_CHUNK_DEST(mp);
852Svi117747					fp->ssthresh = fp->cwnd / 2;
852Svi117747					if (fp->ssthresh < 2 * fp->sfa_pmss) {
852Svi117747						fp->ssthresh =
852Svi117747						    2 * fp->sfa_pmss;
852Svi117747					}
852Svi117747					fp->cwnd = fp->ssthresh;
852Svi117747					fp->pba = 0;
852Svi117747					sctp->sctp_recovery_tsn =
852Svi117747					    sctp->sctp_ltsn - 1;
852Svi117747					*fast_recovery = B_TRUE;
852Svi117747				}
852Svi117747			}
852Svi117747		}
852Svi117747		mp = mp->b_next;
852Svi117747		if (mp == NULL) {
852Svi117747			ump = ump->b_next;
852Svi117747			/* We can't get to the end of the transmit list here */
852Svi117747			ASSERT(ump != NULL);
852Svi117747			mp = ump->b_cont;
852Svi117747		}
852Svi117747		/* We can't hit an unsent chunk here */
852Svi117747		ASSERT(SCTP_CHUNK_ISSENT(mp));
852Svi117747		sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747		xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	}
852Svi117747	return (acked);
852Svi117747}
852Svi117747
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_got_sack(sctp_t *sctp, sctp_chunk_hdr_t *sch)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_sack_chunk_t	*sc;
0Sstevel@tonic-gate	sctp_data_hdr_t		*sdc;
0Sstevel@tonic-gate	sctp_sack_frag_t	*ssf;
0Sstevel@tonic-gate	mblk_t			*ump;
0Sstevel@tonic-gate	mblk_t			*mp;
852Svi117747	mblk_t			*mp1;
852Svi117747	uint32_t		cumtsn;
0Sstevel@tonic-gate	uint32_t		xtsn;
852Svi117747	uint32_t		gapstart = 0;
852Svi117747	uint32_t		gapend = 0;
0Sstevel@tonic-gate	uint32_t		acked = 0;
0Sstevel@tonic-gate	uint16_t		chunklen;
0Sstevel@tonic-gate	sctp_faddr_t		*fp;
0Sstevel@tonic-gate	int			num_gaps;
0Sstevel@tonic-gate	int			trysend = 0;
0Sstevel@tonic-gate	int			i;
0Sstevel@tonic-gate	boolean_t		fast_recovery = B_FALSE;
0Sstevel@tonic-gate	boolean_t		cumack_forward = B_FALSE;
0Sstevel@tonic-gate	boolean_t		fwd_tsn = B_FALSE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate	chunklen = ntohs(sch->sch_len);
0Sstevel@tonic-gate	if (chunklen < (sizeof (*sch) + sizeof (*sc)))
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sc = (sctp_sack_chunk_t *)(sch + 1);
852Svi117747	cumtsn = ntohl(sc->ssc_cumtsn);
852Svi117747
852Svi117747	dprint(2, ("got sack cumtsn %x -> %x\n", sctp->sctp_lastack_rxd,
852Svi117747	    cumtsn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* out of order */
852Svi117747	if (SEQ_LT(cumtsn, sctp->sctp_lastack_rxd))
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate
852Svi117747	if (SEQ_GT(cumtsn, sctp->sctp_ltsn - 1)) {
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInAckUnsent);
852Svi117747		/* Send an ABORT */
852Svi117747		return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Cwnd only done when not in fast recovery mode.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn))
0Sstevel@tonic-gate		fast_recovery = B_TRUE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * .. and if the cum TSN is not moving ahead on account Forward TSN
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_adv_pap))
0Sstevel@tonic-gate		fwd_tsn = B_TRUE;
0Sstevel@tonic-gate
852Svi117747	if (cumtsn == sctp->sctp_lastack_rxd &&
0Sstevel@tonic-gate	    (sctp->sctp_xmit_unacked == NULL ||
0Sstevel@tonic-gate	    !SCTP_CHUNK_ABANDONED(sctp->sctp_xmit_unacked))) {
0Sstevel@tonic-gate		if (sctp->sctp_xmit_unacked != NULL)
0Sstevel@tonic-gate			mp = sctp->sctp_xmit_unacked;
0Sstevel@tonic-gate		else if (sctp->sctp_xmit_head != NULL)
0Sstevel@tonic-gate			mp = sctp->sctp_xmit_head->b_cont;
0Sstevel@tonic-gate		else
0Sstevel@tonic-gate			mp = NULL;
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpInDupAck);
1932Svi117747		/*
1932Svi117747		 * If we were doing a zero win probe and the win
1932Svi117747		 * has now opened to at least MSS, re-transmit the
1932Svi117747		 * zero win probe via sctp_rexmit_packet().
1932Svi117747		 */
1932Svi117747		if (mp != NULL && sctp->sctp_zero_win_probe &&
1932Svi117747		    ntohl(sc->ssc_a_rwnd) >= sctp->sctp_current->sfa_pmss) {
1932Svi117747			mblk_t	*pkt;
1932Svi117747			uint_t	pkt_len;
1932Svi117747			mblk_t	*mp1 = mp;
1932Svi117747			mblk_t	*meta = sctp->sctp_xmit_head;
1932Svi117747
1932Svi117747			/*
1932Svi117747			 * Reset the RTO since we have been backing-off
1932Svi117747			 * to send the ZWP.
1932Svi117747			 */
1932Svi117747			fp = sctp->sctp_current;
1932Svi117747			fp->rto = fp->srtt + 4 * fp->rttvar;
1932Svi117747			/* Resend the ZWP */
1932Svi117747			pkt = sctp_rexmit_packet(sctp, &meta, &mp1, fp,
1932Svi117747			    &pkt_len);
1932Svi117747			if (pkt == NULL) {
1932Svi117747				SCTP_KSTAT(sctp_ss_rexmit_failed);
1932Svi117747				return (0);
1932Svi117747			}
1932Svi117747			ASSERT(pkt_len <= fp->sfa_pmss);
1932Svi117747			sctp->sctp_zero_win_probe = B_FALSE;
1932Svi117747			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1932Svi117747			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
1932Svi117747			sctp_set_iplen(sctp, pkt);
1932Svi117747			sctp_add_sendq(sctp, pkt);
1932Svi117747		}
0Sstevel@tonic-gate	} else {
1932Svi117747		if (sctp->sctp_zero_win_probe) {
1932Svi117747			/*
1932Svi117747			 * Reset the RTO since we have been backing-off
1932Svi117747			 * to send the ZWP.
1932Svi117747			 */
1932Svi117747			fp = sctp->sctp_current;
1932Svi117747			fp->rto = fp->srtt + 4 * fp->rttvar;
1932Svi117747			sctp->sctp_zero_win_probe = B_FALSE;
1932Svi117747			/* This is probably not required */
1932Svi117747			if (!sctp->sctp_rexmitting) {
1932Svi117747				sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1932Svi117747				sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
1932Svi117747			}
1932Svi117747		}
852Svi117747		acked = sctp_cumack(sctp, cumtsn, &mp);
0Sstevel@tonic-gate		sctp->sctp_xmit_unacked = mp;
0Sstevel@tonic-gate		if (acked > 0) {
0Sstevel@tonic-gate			trysend = 1;
0Sstevel@tonic-gate			cumack_forward = B_TRUE;
0Sstevel@tonic-gate			if (fwd_tsn && SEQ_GEQ(sctp->sctp_lastack_rxd,
0Sstevel@tonic-gate			    sctp->sctp_adv_pap)) {
0Sstevel@tonic-gate				cumack_forward = B_FALSE;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	num_gaps = ntohs(sc->ssc_numfrags);
0Sstevel@tonic-gate	if (num_gaps == 0 || mp == NULL || !SCTP_CHUNK_ISSENT(mp) ||
0Sstevel@tonic-gate	    chunklen < (sizeof (*sch) + sizeof (*sc) +
0Sstevel@tonic-gate	    num_gaps * sizeof (*ssf))) {
0Sstevel@tonic-gate		goto ret;
0Sstevel@tonic-gate	}
852Svi117747#ifdef	DEBUG
852Svi117747	/*
852Svi117747	 * Since we delete any message that has been acked completely,
852Svi117747	 * the unacked chunk must belong to sctp_xmit_head (as
852Svi117747	 * we don't have a back pointer from the mp to the meta data
852Svi117747	 * we do this).
852Svi117747	 */
852Svi117747	{
852Svi117747		mblk_t	*mp2 = sctp->sctp_xmit_head->b_cont;
852Svi117747
852Svi117747		while (mp2 != NULL) {
852Svi117747			if (mp2 == mp)
852Svi117747				break;
852Svi117747			mp2 = mp2->b_next;
852Svi117747		}
852Svi117747		ASSERT(mp2 != NULL);
852Svi117747	}
852Svi117747#endif
0Sstevel@tonic-gate	ump = sctp->sctp_xmit_head;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
852Svi117747	 * Just remember where we started from, in case we need to call
852Svi117747	 * sctp_process_uo_gaps() if the gap blocks are unordered.
852Svi117747	 */
852Svi117747	mp1 = mp;
852Svi117747
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	ASSERT(xtsn == cumtsn + 1);
852Svi117747
852Svi117747	/*
0Sstevel@tonic-gate	 * Go through SACK gaps. They are ordered based on start TSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	ssf = (sctp_sack_frag_t *)(sc + 1);
852Svi117747	for (i = 0; i < num_gaps; i++, ssf++) {
852Svi117747		if (gapstart != 0) {
852Svi117747			/* check for unordered gap */
852Svi117747			if (SEQ_LEQ(cumtsn + ntohs(ssf->ssf_start), gapstart)) {
852Svi117747				acked += sctp_process_uo_gaps(sctp,
852Svi117747				    cumtsn, ssf, num_gaps - i,
852Svi117747				    sctp->sctp_xmit_head, mp1,
852Svi117747				    &trysend, &fast_recovery, gapstart);
852Svi117747				if (trysend < 0) {
852Svi117747					BUMP_MIB(&sctp_mib, sctpInAckUnsent);
852Svi117747					return (-1);
852Svi117747				}
852Svi117747				break;
852Svi117747			}
852Svi117747		}
852Svi117747		gapstart = cumtsn + ntohs(ssf->ssf_start);
852Svi117747		gapend = cumtsn + ntohs(ssf->ssf_end);
852Svi117747
852Svi117747		/* SACK for TSN we have not sent - ABORT */
852Svi117747		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
852Svi117747		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
852Svi117747			BUMP_MIB(&sctp_mib, sctpInAckUnsent);
852Svi117747			return (-1);
852Svi117747		} else if (SEQ_LT(gapend, gapstart)) {
852Svi117747			break;
852Svi117747		}
852Svi117747		/*
852Svi117747		 * Let's start at the current TSN (for the 1st gap we start
852Svi117747		 * from the cumulative TSN, for subsequent ones we start from
852Svi117747		 * where the previous gapend was found - second while loop
852Svi117747		 * below) and walk the transmit list till we find the TSN
852Svi117747		 * corresponding to gapstart. All the unacked chunks till we
852Svi117747		 * get to the chunk with TSN == gapstart will have their
852Svi117747		 * SACKCNT incremented by 1. Note since the gap blocks are
852Svi117747		 * ordered, we won't be incrementing the SACKCNT for an
852Svi117747		 * unacked chunk by more than one while processing the gap
852Svi117747		 * blocks. If the SACKCNT for any unacked chunk exceeds
852Svi117747		 * the fast retransmit threshold, we will fast retransmit
852Svi117747		 * after processing all the gap blocks.
852Svi117747		 */
852Svi117747		ASSERT(SEQ_LT(xtsn, gapstart));
0Sstevel@tonic-gate		while (xtsn != gapstart) {
0Sstevel@tonic-gate			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
0Sstevel@tonic-gate			if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) {
0Sstevel@tonic-gate				SCTP_CHUNK_REXMIT(mp);
0Sstevel@tonic-gate				sctp->sctp_chk_fast_rexmit = B_TRUE;
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				if (!fast_recovery) {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * Entering fast recovery.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate					fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate					fp->ssthresh = fp->cwnd / 2;
0Sstevel@tonic-gate					if (fp->ssthresh < 2 * fp->sfa_pmss) {
0Sstevel@tonic-gate						fp->ssthresh =
0Sstevel@tonic-gate						    2 * fp->sfa_pmss;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					fp->cwnd = fp->ssthresh;
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					sctp->sctp_recovery_tsn =
0Sstevel@tonic-gate					    sctp->sctp_ltsn - 1;
0Sstevel@tonic-gate					fast_recovery = B_TRUE;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * Peer may have reneged on this chunk, so un-sack
0Sstevel@tonic-gate			 * it now. If the peer did renege, we need to
0Sstevel@tonic-gate			 * readjust unacked.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (SCTP_CHUNK_ISACKED(mp)) {
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				fp->suna += chunklen;
0Sstevel@tonic-gate				sctp->sctp_unacked += chunklen - sizeof (*sdc);
0Sstevel@tonic-gate				SCTP_CHUNK_CLEAR_ACKED(mp);
0Sstevel@tonic-gate				if (!fp->timer_running) {
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate
0Sstevel@tonic-gate			mp = mp->b_next;
0Sstevel@tonic-gate			if (mp == NULL) {
0Sstevel@tonic-gate				ump = ump->b_next;
852Svi117747				/*
852Svi117747				 * ump can't be NULL given the sanity check
852Svi117747				 * above.
852Svi117747				 */
852Svi117747				ASSERT(ump != NULL);
0Sstevel@tonic-gate				mp = ump->b_cont;
0Sstevel@tonic-gate			}
852Svi117747			/*
852Svi117747			 * mp can't be unsent given the sanity check above.
852Svi117747			 */
852Svi117747			ASSERT(SCTP_CHUNK_ISSENT(mp));
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate		}
852Svi117747		/*
852Svi117747		 * Now that we have found the chunk with TSN == 'gapstart',
852Svi117747		 * let's walk till we hit the chunk with TSN == 'gapend'.
852Svi117747		 * All intermediate chunks will be marked ACKED, if they
852Svi117747		 * haven't already been.
852Svi117747		 */
0Sstevel@tonic-gate		while (SEQ_LEQ(xtsn, gapend)) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * SACKed
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			SCTP_CHUNK_SET_SACKCNT(mp, 0);
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISACKED(mp)) {
0Sstevel@tonic-gate				SCTP_CHUNK_ACKED(mp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate				ASSERT(fp->suna >= chunklen);
0Sstevel@tonic-gate				fp->suna -= chunklen;
0Sstevel@tonic-gate				if (fp->suna == 0) {
0Sstevel@tonic-gate					/* All outstanding data acked. */
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_STOP(fp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->acked += chunklen;
0Sstevel@tonic-gate				acked += chunklen;
0Sstevel@tonic-gate				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
0Sstevel@tonic-gate				ASSERT(sctp->sctp_unacked >= 0);
0Sstevel@tonic-gate			}
852Svi117747			/* Go to the next chunk of the current message */
0Sstevel@tonic-gate			mp = mp->b_next;
852Svi117747			/*
852Svi117747			 * Move to the next message in the transmit list
852Svi117747			 * if we are done with all the chunks from the current
852Svi117747			 * message. Note, it is possible to hit the end of the
852Svi117747			 * transmit list here, i.e. if we have already completed
852Svi117747			 * processing the gap block.
852Svi117747			 * Also, note that we break here, which means we
852Svi117747			 * continue processing gap blocks, if any. In case of
852Svi117747			 * ordered gap blocks there can't be any following
852Svi117747			 * this (if there is it will fail the sanity check
852Svi117747			 * above). In case of un-ordered gap blocks we will
852Svi117747			 * switch to sctp_process_uo_gaps().  In either case
852Svi117747			 * it should be fine to continue with NULL ump/mp,
852Svi117747			 * but we just reset it to xmit_head.
852Svi117747			 */
0Sstevel@tonic-gate			if (mp == NULL) {
0Sstevel@tonic-gate				ump = ump->b_next;
0Sstevel@tonic-gate				if (ump == NULL) {
852Svi117747					ASSERT(xtsn == gapend);
852Svi117747					ump = sctp->sctp_xmit_head;
852Svi117747					mp = mp1;
852Svi117747					sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747					xtsn = ntohl(sdc->sdh_tsn);
852Svi117747					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				mp = ump->b_cont;
0Sstevel@tonic-gate			}
852Svi117747			/*
852Svi117747			 * Likewise, we could hit an unsent chunk once we have
852Svi117747			 * completed processing the gap block. Again, it is
852Svi117747			 * fine to continue processing gap blocks with mp
852Svi117747			 * pointing to the unsent chunk, because if there
852Svi117747			 * are more ordered gap blocks, they will fail the
852Svi117747			 * sanity check, and if there are un-ordered gap blocks,
852Svi117747			 * we will continue processing in sctp_process_uo_gaps()
852Svi117747			 * We just reset the mp to the one we started with.
852Svi117747			 */
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISSENT(mp)) {
852Svi117747				ASSERT(xtsn == gapend);
852Svi117747				ump = sctp->sctp_xmit_head;
852Svi117747				mp = mp1;
852Svi117747				sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747				xtsn = ntohl(sdc->sdh_tsn);
852Svi117747				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (sctp->sctp_prsctp_aware)
0Sstevel@tonic-gate		sctp_check_abandoned_data(sctp, sctp->sctp_current);
0Sstevel@tonic-gate	if (sctp->sctp_chk_fast_rexmit)
0Sstevel@tonic-gate		sctp_fast_rexmit(sctp);
0Sstevel@tonic-gateret:
0Sstevel@tonic-gate	trysend += sctp_set_frwnd(sctp, ntohl(sc->ssc_a_rwnd));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If receive window is closed while there is unsent data,
0Sstevel@tonic-gate	 * set a timer for doing zero window probes.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_frwnd == 0 && sctp->sctp_unacked == 0 &&
0Sstevel@tonic-gate	    sctp->sctp_unsent != 0) {
0Sstevel@tonic-gate		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
0Sstevel@tonic-gate		    sctp->sctp_current->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Set cwnd for all destinations.
0Sstevel@tonic-gate	 * Congestion window gets increased only when cumulative
0Sstevel@tonic-gate	 * TSN moves forward, we're not in fast recovery, and
0Sstevel@tonic-gate	 * cwnd has been fully utilized (almost fully, need to allow
0Sstevel@tonic-gate	 * some leeway due to non-MSS sized messages).
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_current->acked == acked) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Fast-path, only data sent to sctp_current got acked.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		fp = sctp->sctp_current;
0Sstevel@tonic-gate		if (cumack_forward && !fast_recovery &&
0Sstevel@tonic-gate		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
0Sstevel@tonic-gate			if (fp->cwnd < fp->ssthresh) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Slow start
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (fp->acked > fp->sfa_pmss) {
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					fp->cwnd += fp->acked;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Congestion avoidance
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				fp->pba += fp->acked;
0Sstevel@tonic-gate				if (fp->pba >= fp->cwnd) {
0Sstevel@tonic-gate					fp->pba -= fp->cwnd;
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate					fp->cwnd = MIN(fp->cwnd,
0Sstevel@tonic-gate					    sctp->sctp_cwnd_max);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Limit the burst of transmitted data segments.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) {
0Sstevel@tonic-gate			fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		fp->acked = 0;
1735Skcpoon		goto check_ss_rxmit;
0Sstevel@tonic-gate	}
1932Svi117747	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
0Sstevel@tonic-gate		if (cumack_forward && fp->acked && !fast_recovery &&
0Sstevel@tonic-gate		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
0Sstevel@tonic-gate			if (fp->cwnd < fp->ssthresh) {
0Sstevel@tonic-gate				if (fp->acked > fp->sfa_pmss) {
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					fp->cwnd += fp->acked;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				fp->pba += fp->acked;
0Sstevel@tonic-gate				if (fp->pba >= fp->cwnd) {
0Sstevel@tonic-gate					fp->pba -= fp->cwnd;
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate					fp->cwnd = MIN(fp->cwnd,
0Sstevel@tonic-gate					    sctp->sctp_cwnd_max);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) {
0Sstevel@tonic-gate			fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		fp->acked = 0;
0Sstevel@tonic-gate	}
1735Skcpooncheck_ss_rxmit:
1735Skcpoon	/*
1735Skcpoon	 * If this is a SACK following a timeout, check if there are
1735Skcpoon	 * still unacked chunks (sent before the timeout) that we can
1735Skcpoon	 * send.
1735Skcpoon	 */
1735Skcpoon	if (sctp->sctp_rexmitting) {
1735Skcpoon		if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_rxt_maxtsn)) {
1735Skcpoon			/*
1735Skcpoon			 * As we are in retransmission phase, we may get a
1735Skcpoon			 * SACK which indicates some new chunks are received
1735Skcpoon			 * but cum_tsn does not advance.  During this
1735Skcpoon			 * phase, the other side advances cum_tsn only because
1735Skcpoon			 * it receives our retransmitted chunks.  Only
1735Skcpoon			 * this signals that some chunks are still
1735Skcpoon			 * missing.
1735Skcpoon			 */
1735Skcpoon			if (cumack_forward)
1735Skcpoon				sctp_ss_rexmit(sctp);
1735Skcpoon		} else {
1735Skcpoon			sctp->sctp_rexmitting = B_FALSE;
1735Skcpoon			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1735Skcpoon			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
1735Skcpoon		}
1735Skcpoon	}
0Sstevel@tonic-gate	return (trysend);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Returns 0 if the caller should stop processing any more chunks,
0Sstevel@tonic-gate * 1 if the caller should skip this chunk and continue processing.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_strange_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *errmp;
0Sstevel@tonic-gate	size_t len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate	/* check top two bits for action required */
0Sstevel@tonic-gate	if (ch->sch_id & 0x40) {	/* also matches 0xc0 */
0Sstevel@tonic-gate		len = ntohs(ch->sch_len);
0Sstevel@tonic-gate		errmp = sctp_make_err(sctp, SCTP_ERR_UNREC_CHUNK, ch, len);
0Sstevel@tonic-gate		if (errmp != NULL)
0Sstevel@tonic-gate			sctp_send_err(sctp, errmp, fp);
0Sstevel@tonic-gate		if ((ch->sch_id & 0xc0) == 0xc0) {
0Sstevel@tonic-gate			/* skip and continue */
0Sstevel@tonic-gate			return (1);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* stop processing */
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (ch->sch_id & 0x80) {
0Sstevel@tonic-gate		/* skip and continue, no error */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* top two bits are clear; stop processing and no error */
0Sstevel@tonic-gate	return (0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Basic sanity checks on all input chunks and parameters: they must
0Sstevel@tonic-gate * be of legitimate size for their purported type, and must follow
0Sstevel@tonic-gate * ordering conventions as defined in rfc2960.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * Returns 1 if the chunk and all encloded params are legitimate,
0Sstevel@tonic-gate * 0 otherwise.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate/*ARGSUSED*/
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_check_input(sctp_t *sctp, sctp_chunk_hdr_t *ch, ssize_t len, int first)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_parm_hdr_t	*ph;
0Sstevel@tonic-gate	void		*p = NULL;
0Sstevel@tonic-gate	ssize_t		clen;
0Sstevel@tonic-gate	uint16_t	ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate	if (ch_len > len) {
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_DATA:
0Sstevel@tonic-gate		if (ch_len < sizeof (sctp_data_hdr_t)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate	case CHUNK_INIT_ACK:
0Sstevel@tonic-gate		{
0Sstevel@tonic-gate			ssize_t	remlen = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * INIT and INIT-ACK chunks must not be bundled with
0Sstevel@tonic-gate			 * any other.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
0Sstevel@tonic-gate			    (ch_len < (sizeof (*ch) +
0Sstevel@tonic-gate			    sizeof (sctp_init_chunk_t)))) {
0Sstevel@tonic-gate				return (0);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/* may have params that need checking */
0Sstevel@tonic-gate			p = (char *)(ch + 1) + sizeof (sctp_init_chunk_t);
0Sstevel@tonic-gate			clen = ch_len - (sizeof (*ch) +
0Sstevel@tonic-gate			    sizeof (sctp_init_chunk_t));
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SACK:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (sctp_sack_chunk_t))) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* dup and gap reports checked by got_sack() */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (uint32_t))) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_ERROR:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* may have params that need checking */
0Sstevel@tonic-gate		p = ch + 1;
0Sstevel@tonic-gate		clen = ch_len - sizeof (*ch);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_ECNE:
0Sstevel@tonic-gate	case CHUNK_CWR:
0Sstevel@tonic-gate	case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate	case CHUNK_HEARTBEAT_ACK:
0Sstevel@tonic-gate	/* Full ASCONF chunk and parameter checks are in asconf.c */
0Sstevel@tonic-gate	case CHUNK_ASCONF:
0Sstevel@tonic-gate	case CHUNK_ASCONF_ACK:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* heartbeat data checked by process_heartbeat() */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		{
0Sstevel@tonic-gate			ssize_t remlen = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * SHUTDOWN-COMPLETE chunk must not be bundled with any
0Sstevel@tonic-gate			 * other
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
0Sstevel@tonic-gate			    ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate				return (0);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_COOKIE:
0Sstevel@tonic-gate	case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch) || !first) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_FORWARD_TSN:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (uint32_t)))
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	default:
0Sstevel@tonic-gate		return (1);	/* handled by strange_chunk() */
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* check and byteorder parameters */
0Sstevel@tonic-gate	if (clen <= 0) {
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT(p != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ph = p;
0Sstevel@tonic-gate	while (ph != NULL && clen > 0) {
0Sstevel@tonic-gate		ch_len = ntohs(ph->sph_len);
0Sstevel@tonic-gate		if (ch_len > len || ch_len < sizeof (*ph)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ph = sctp_next_parm(ph, &clen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* All OK */
0Sstevel@tonic-gate	return (1);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/* ARGSUSED */
0Sstevel@tonic-gatestatic sctp_hdr_t *
0Sstevel@tonic-gatefind_sctp_hdrs(mblk_t *mp, in6_addr_t *src, in6_addr_t *dst,
*3318Srshoaib    uint_t *ifindex, uint_t *ip_hdr_len, ip6_pkt_t *ipp, ip_pktinfo_t *pinfo)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	uchar_t	*rptr;
0Sstevel@tonic-gate	ipha_t	*ip4h;
0Sstevel@tonic-gate	ip6_t	*ip6h;
0Sstevel@tonic-gate	mblk_t	*mp1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	rptr = mp->b_rptr;
0Sstevel@tonic-gate	if (IPH_HDR_VERSION(rptr) == IPV4_VERSION) {
0Sstevel@tonic-gate		*ip_hdr_len = IPH_HDR_LENGTH(rptr);
0Sstevel@tonic-gate		ip4h = (ipha_t *)rptr;
0Sstevel@tonic-gate		IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_src, src);
0Sstevel@tonic-gate		IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_dst, dst);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		ipp->ipp_fields |= IPPF_HOPLIMIT;
0Sstevel@tonic-gate		ipp->ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl;
*3318Srshoaib		if (pinfo != NULL && (pinfo->ip_pkt_flags & IPF_RECVIF)) {
0Sstevel@tonic-gate			ipp->ipp_fields |= IPPF_IFINDEX;
*3318Srshoaib			ipp->ipp_ifindex = pinfo->ip_pkt_ifindex;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
0Sstevel@tonic-gate		ip6h = (ip6_t *)rptr;
0Sstevel@tonic-gate		ipp->ipp_fields = IPPF_HOPLIMIT;
0Sstevel@tonic-gate		ipp->ipp_hoplimit = ip6h->ip6_hops;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (ip6h->ip6_nxt != IPPROTO_SCTP) {
0Sstevel@tonic-gate			/* Look for ifindex information */
0Sstevel@tonic-gate			if (ip6h->ip6_nxt == IPPROTO_RAW) {
0Sstevel@tonic-gate				ip6i_t *ip6i = (ip6i_t *)ip6h;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
0Sstevel@tonic-gate					ASSERT(ip6i->ip6i_ifindex != 0);
0Sstevel@tonic-gate					ipp->ipp_fields |= IPPF_IFINDEX;
0Sstevel@tonic-gate					ipp->ipp_ifindex = ip6i->ip6i_ifindex;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				rptr = (uchar_t *)&ip6i[1];
0Sstevel@tonic-gate				mp->b_rptr = rptr;
0Sstevel@tonic-gate				if (rptr == mp->b_wptr) {
0Sstevel@tonic-gate					mp1 = mp->b_cont;
0Sstevel@tonic-gate					freeb(mp);
0Sstevel@tonic-gate					mp = mp1;
0Sstevel@tonic-gate					rptr = mp->b_rptr;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				ASSERT(mp->b_wptr - rptr >=
0Sstevel@tonic-gate				    IPV6_HDR_LEN + sizeof (sctp_hdr_t));
0Sstevel@tonic-gate				ip6h = (ip6_t *)rptr;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * Find any potentially interesting extension headers
0Sstevel@tonic-gate			 * as well as the length of the IPv6 + extension
0Sstevel@tonic-gate			 * headers.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			*ip_hdr_len = ip_find_hdr_v6(mp, ip6h, ipp, NULL);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			*ip_hdr_len = IPV6_HDR_LEN;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		*src = ip6h->ip6_src;
0Sstevel@tonic-gate		*dst = ip6h->ip6_dst;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
0Sstevel@tonic-gate	return ((sctp_hdr_t *)&rptr[*ip_hdr_len]);
0Sstevel@tonic-gate#undef IPVER
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic mblk_t *
0Sstevel@tonic-gatesctp_check_in_policy(mblk_t *mp, mblk_t *ipsec_mp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	ipsec_in_t *ii;
0Sstevel@tonic-gate	boolean_t check = B_TRUE;
0Sstevel@tonic-gate	boolean_t policy_present;
0Sstevel@tonic-gate	ipha_t *ipha;
0Sstevel@tonic-gate	ip6_t *ip6h;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
0Sstevel@tonic-gate	ASSERT(ii->ipsec_in_type == IPSEC_IN);
0Sstevel@tonic-gate	if (ii->ipsec_in_dont_check) {
0Sstevel@tonic-gate		check = B_FALSE;
0Sstevel@tonic-gate		if (!ii->ipsec_in_secure) {
0Sstevel@tonic-gate			freeb(ipsec_mp);
0Sstevel@tonic-gate			ipsec_mp = NULL;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
0Sstevel@tonic-gate		policy_present = ipsec_inbound_v4_policy_present;
0Sstevel@tonic-gate		ipha = (ipha_t *)mp->b_rptr;
0Sstevel@tonic-gate		ip6h = NULL;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		policy_present = ipsec_inbound_v6_policy_present;
0Sstevel@tonic-gate		ipha = NULL;
0Sstevel@tonic-gate		ip6h = (ip6_t *)mp->b_rptr;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (check && policy_present) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * The conn_t parameter is NULL because we already know
0Sstevel@tonic-gate		 * nobody's home.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		ipsec_mp = ipsec_check_global_policy(ipsec_mp, (conn_t *)NULL,
0Sstevel@tonic-gate		    ipha, ip6h, B_TRUE);
0Sstevel@tonic-gate		if (ipsec_mp == NULL)
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (ipsec_mp != NULL)
0Sstevel@tonic-gate		freeb(ipsec_mp);
0Sstevel@tonic-gate	return (mp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/* Handle out-of-the-blue packets */
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_ootb_input(mblk_t *mp, ill_t *recv_ill, uint_t ipif_seqid,
0Sstevel@tonic-gate    zoneid_t zoneid, boolean_t mctl_present)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_t			*sctp;
0Sstevel@tonic-gate	sctp_chunk_hdr_t	*ch;
0Sstevel@tonic-gate	sctp_hdr_t		*sctph;
0Sstevel@tonic-gate	in6_addr_t		src, dst;
0Sstevel@tonic-gate	uint_t			ip_hdr_len;
0Sstevel@tonic-gate	uint_t			ifindex;
0Sstevel@tonic-gate	ip6_pkt_t		ipp;
0Sstevel@tonic-gate	ssize_t			mlen;
*3318Srshoaib	ip_pktinfo_t		*pinfo = NULL;
0Sstevel@tonic-gate	mblk_t			*first_mp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_MIB(&sctp_mib, sctpOutOfBlue);
0Sstevel@tonic-gate	BUMP_MIB(&sctp_mib, sctpInSCTPPkts);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	first_mp = mp;
0Sstevel@tonic-gate	if (mctl_present)
0Sstevel@tonic-gate		mp = mp->b_cont;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Initiate IPPf processing, if needed. */
0Sstevel@tonic-gate	if (IPP_ENABLED(IPP_LOCAL_IN)) {
0Sstevel@tonic-gate		ip_process(IPP_LOCAL_IN, &mp,
0Sstevel@tonic-gate		    recv_ill->ill_phyint->phyint_ifindex);
0Sstevel@tonic-gate		if (mp == NULL) {
0Sstevel@tonic-gate			if (mctl_present)
0Sstevel@tonic-gate				freeb(first_mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (mp->b_cont != NULL) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All subsequent code is vastly simplified if it can
0Sstevel@tonic-gate		 * assume a single contiguous chunk of data.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (pullupmsg(mp, -1) == 0) {
3284Sapersson			BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate			freemsg(first_mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We don't really need to call this function...  Need to
0Sstevel@tonic-gate	 * optimize later.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len,
0Sstevel@tonic-gate	    &ipp, pinfo);
0Sstevel@tonic-gate	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
0Sstevel@tonic-gate	if ((ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen)) == NULL) {
0Sstevel@tonic-gate		dprint(3, ("sctp_ootb_input: invalid packet\n"));
3284Sapersson		BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate		freemsg(first_mp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate		/* no listener; send abort  */
0Sstevel@tonic-gate		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		sctp_send_abort(gsctp, sctp_init2vtag(ch), 0,
0Sstevel@tonic-gate		    NULL, 0, mp, 0, B_TRUE);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_INIT_ACK:
0Sstevel@tonic-gate		/* check for changed src addr */
0Sstevel@tonic-gate		sctp = sctp_addrlist2sctp(mp, sctph, ch, ipif_seqid, zoneid);
0Sstevel@tonic-gate		if (sctp != NULL) {
0Sstevel@tonic-gate			/* success; proceed to normal path */
0Sstevel@tonic-gate			mutex_enter(&sctp->sctp_lock);
0Sstevel@tonic-gate			if (sctp->sctp_running) {
0Sstevel@tonic-gate				if (!sctp_add_recvq(sctp, mp, B_FALSE)) {
3284Sapersson					BUMP_MIB(recv_ill->ill_ip_mib,
3284Sapersson					    ipIfStatsInDiscards);
0Sstevel@tonic-gate					freemsg(mp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * If the source address is changed, we
0Sstevel@tonic-gate				 * don't need to worry too much about
0Sstevel@tonic-gate				 * out of order processing.  So we don't
0Sstevel@tonic-gate				 * check if the recvq is empty or not here.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp->sctp_running = B_TRUE;
0Sstevel@tonic-gate				mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate				sctp_input_data(sctp, mp, NULL);
0Sstevel@tonic-gate				WAKE_SCTP(sctp);
0Sstevel@tonic-gate				sctp_process_sendq(sctp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (mctl_present)
0Sstevel@tonic-gate			freeb(first_mp);
0Sstevel@tonic-gate		/* else bogus init ack; drop it */
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		sctp_ootb_shutdown_ack(gsctp, mp, ip_hdr_len);
0Sstevel@tonic-gate		sctp_process_sendq(gsctp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	case CHUNK_ERROR:
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		if (mctl_present)
0Sstevel@tonic-gate			freeb(first_mp);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	default:
0Sstevel@tonic-gate		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		sctp_send_abort(gsctp, sctph->sh_verf, 0, NULL, 0, mp, 0,
0Sstevel@tonic-gate		    B_TRUE);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sctp_process_sendq(gsctp);
0Sstevel@tonic-gate	freemsg(mp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_input(conn_t *connp, ipha_t *ipha, mblk_t *mp, mblk_t *first_mp,
0Sstevel@tonic-gate    ill_t *recv_ill, boolean_t isv4, boolean_t mctl_present)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_t *sctp = CONN2SCTP(connp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We check some fields in conn_t without holding a lock.
0Sstevel@tonic-gate	 * This should be fine.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (CONN_INBOUND_POLICY_PRESENT(connp) || mctl_present) {
0Sstevel@tonic-gate		first_mp = ipsec_check_inbound_policy(first_mp, connp,
0Sstevel@tonic-gate		    ipha, NULL, mctl_present);
0Sstevel@tonic-gate		if (first_mp == NULL) {
3284Sapersson			BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Initiate IPPF processing for fastpath */
0Sstevel@tonic-gate	if (IPP_ENABLED(IPP_LOCAL_IN)) {
0Sstevel@tonic-gate		ip_process(IPP_LOCAL_IN, &mp,
0Sstevel@tonic-gate		    recv_ill->ill_phyint->phyint_ifindex);
0Sstevel@tonic-gate		if (mp == NULL) {
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			if (mctl_present)
0Sstevel@tonic-gate				freeb(first_mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		} else if (mctl_present) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * ip_process might return a new mp.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			ASSERT(first_mp != mp);
0Sstevel@tonic-gate			first_mp->b_cont = mp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			first_mp = mp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (connp->conn_recvif || connp->conn_recvslla ||
*3318Srshoaib	    connp->conn_ip_recvpktinfo) {
0Sstevel@tonic-gate		int in_flags = 0;
0Sstevel@tonic-gate
*3318Srshoaib		if (connp->conn_recvif || connp->conn_ip_recvpktinfo) {
0Sstevel@tonic-gate			in_flags = IPF_RECVIF;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (connp->conn_recvslla) {
0Sstevel@tonic-gate			in_flags |= IPF_RECVSLLA;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (isv4) {
*3318Srshoaib			mp = ip_add_info(mp, recv_ill, in_flags,
*3318Srshoaib			    IPCL_ZONEID(connp));
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			mp = ip_add_info_v6(mp, recv_ill,
0Sstevel@tonic-gate			    &(((ip6_t *)ipha)->ip6_dst));
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (mp == NULL) {
3284Sapersson			BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			if (mctl_present)
0Sstevel@tonic-gate				freeb(first_mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		} else if (mctl_present) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * ip_add_info might return a new mp.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			ASSERT(first_mp != mp);
0Sstevel@tonic-gate			first_mp->b_cont = mp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			first_mp = mp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mutex_enter(&sctp->sctp_lock);
0Sstevel@tonic-gate	if (sctp->sctp_running) {
0Sstevel@tonic-gate		if (mctl_present)
0Sstevel@tonic-gate			mp->b_prev = first_mp;
0Sstevel@tonic-gate		if (!sctp_add_recvq(sctp, mp, B_FALSE)) {
3284Sapersson			BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate			freemsg(first_mp);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate		SCTP_REFRELE(sctp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sctp->sctp_running = B_TRUE;
0Sstevel@tonic-gate		mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		mutex_enter(&sctp->sctp_recvq_lock);
0Sstevel@tonic-gate		if (sctp->sctp_recvq != NULL) {
0Sstevel@tonic-gate			if (mctl_present)
0Sstevel@tonic-gate				mp->b_prev = first_mp;
0Sstevel@tonic-gate			if (!sctp_add_recvq(sctp, mp, B_TRUE)) {
3284Sapersson				BUMP_MIB(recv_ill->ill_ip_mib,
3284Sapersson				    ipIfStatsInDiscards);
0Sstevel@tonic-gate				freemsg(first_mp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			mutex_exit(&sctp->sctp_recvq_lock);
0Sstevel@tonic-gate			WAKE_SCTP(sctp);
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	mutex_exit(&sctp->sctp_recvq_lock);
0Sstevel@tonic-gate	sctp_input_data(sctp, mp, (mctl_present ? first_mp : NULL));
0Sstevel@tonic-gate	WAKE_SCTP(sctp);
0Sstevel@tonic-gate	sctp_process_sendq(sctp);
0Sstevel@tonic-gate	SCTP_REFRELE(sctp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_process_abort(sctp_t *sctp, sctp_chunk_hdr_t *ch, int err)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	BUMP_MIB(&sctp_mib, sctpAborted);
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_assoc_event(sctp, SCTP_COMM_LOST,
0Sstevel@tonic-gate	    ntohs(((sctp_parm_hdr_t *)(ch + 1))->sph_type), ch);
0Sstevel@tonic-gate	sctp_clean_death(sctp, err);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_input_data(sctp_t *sctp, mblk_t *mp, mblk_t *ipsec_mp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t	*ch;
0Sstevel@tonic-gate	ssize_t			mlen;
0Sstevel@tonic-gate	int			gotdata;
0Sstevel@tonic-gate	int			trysend;
0Sstevel@tonic-gate	sctp_faddr_t		*fp;
0Sstevel@tonic-gate	sctp_init_chunk_t	*iack;
0Sstevel@tonic-gate	uint32_t		tsn;
0Sstevel@tonic-gate	sctp_data_hdr_t		*sdc;
0Sstevel@tonic-gate	ip6_pkt_t		ipp;
0Sstevel@tonic-gate	in6_addr_t		src;
0Sstevel@tonic-gate	in6_addr_t		dst;
0Sstevel@tonic-gate	uint_t			ifindex;
0Sstevel@tonic-gate	sctp_hdr_t		*sctph;
0Sstevel@tonic-gate	uint_t			ip_hdr_len;
0Sstevel@tonic-gate	mblk_t			*dups = NULL;
0Sstevel@tonic-gate	int			recv_adaption;
0Sstevel@tonic-gate	boolean_t		wake_eager = B_FALSE;
0Sstevel@tonic-gate	mblk_t			*pinfo_mp;
*3318Srshoaib	ip_pktinfo_t		*pinfo = NULL;
0Sstevel@tonic-gate	in6_addr_t		peer_src;
0Sstevel@tonic-gate	int64_t			now;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (DB_TYPE(mp) != M_DATA) {
0Sstevel@tonic-gate		ASSERT(DB_TYPE(mp) == M_CTL);
*3318Srshoaib		if (MBLKL(mp) == sizeof (ip_pktinfo_t) &&
*3318Srshoaib		    ((ip_pktinfo_t *)mp->b_rptr)->ip_pkt_ulp_type ==
0Sstevel@tonic-gate		    IN_PKTINFO) {
*3318Srshoaib			pinfo = (ip_pktinfo_t *)mp->b_rptr;
0Sstevel@tonic-gate			pinfo_mp = mp;
0Sstevel@tonic-gate			mp = mp->b_cont;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			if (ipsec_mp != NULL)
0Sstevel@tonic-gate				freeb(ipsec_mp);
0Sstevel@tonic-gate			sctp_icmp_error(sctp, mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT(DB_TYPE(mp) == M_DATA);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (mp->b_cont != NULL) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All subsequent code is vastly simplified if it can
0Sstevel@tonic-gate		 * assume a single contiguous chunk of data.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (pullupmsg(mp, -1) == 0) {
3284Sapersson			BUMP_MIB(&ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate			if (ipsec_mp != NULL)
0Sstevel@tonic-gate				freeb(ipsec_mp);
0Sstevel@tonic-gate			if (pinfo != NULL)
0Sstevel@tonic-gate				freeb(pinfo_mp);
0Sstevel@tonic-gate			freemsg(mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ipkts);
0Sstevel@tonic-gate	sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len,
0Sstevel@tonic-gate	    &ipp, pinfo);
0Sstevel@tonic-gate	if (pinfo != NULL)
0Sstevel@tonic-gate		freeb(pinfo_mp);
0Sstevel@tonic-gate	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
0Sstevel@tonic-gate	ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen);
0Sstevel@tonic-gate	if (ch == NULL) {
3284Sapersson		BUMP_MIB(&ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate		if (ipsec_mp != NULL)
0Sstevel@tonic-gate			freeb(ipsec_mp);
0Sstevel@tonic-gate		freemsg(mp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (!sctp_check_input(sctp, ch, mlen, 1)) {
3284Sapersson		BUMP_MIB(&ip_mib, ipIfStatsInDiscards);
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Check verfication tag (special handling for INIT,
0Sstevel@tonic-gate	 * COOKIE, SHUTDOWN_COMPLETE and SHUTDOWN_ACK chunks).
0Sstevel@tonic-gate	 * ABORTs are handled in the chunk processing loop, since
0Sstevel@tonic-gate	 * may not appear first. All other checked chunks must
0Sstevel@tonic-gate	 * appear first, or will have been dropped by check_input().
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate		if (sctph->sh_verf != 0) {
0Sstevel@tonic-gate			/* drop it */
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		if (sctph->sh_verf == sctp->sctp_lvtag)
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		if (sctph->sh_verf == sctp->sctp_fvtag &&
0Sstevel@tonic-gate		    SCTP_GET_TBIT(ch)) {
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* else drop it */
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_COOKIE:
0Sstevel@tonic-gate		/* handled below */
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate		if (sctp->sctp_state > SCTPS_BOUND &&
0Sstevel@tonic-gate		    sctp->sctp_state < SCTPS_ESTABLISHED) {
0Sstevel@tonic-gate			/* treat as OOTB */
0Sstevel@tonic-gate			sctp_ootb_shutdown_ack(sctp, mp, ip_hdr_len);
0Sstevel@tonic-gate			if (ipsec_mp != NULL)
0Sstevel@tonic-gate				freeb(ipsec_mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* else fallthru */
0Sstevel@tonic-gate	default:
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All other packets must have a valid
0Sstevel@tonic-gate		 * verification tag, however if this is a
0Sstevel@tonic-gate		 * listener, we use a refined version of
0Sstevel@tonic-gate		 * out-of-the-blue logic.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (sctph->sh_verf != sctp->sctp_lvtag &&
0Sstevel@tonic-gate		    sctp->sctp_state != SCTPS_LISTEN) {
0Sstevel@tonic-gate			/* drop it */
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Have a valid sctp for this packet */
0Sstevel@tonic-gate	fp = sctp_lookup_faddr(sctp, &src);
1676Sjpk	dprint(2, ("sctp_dispatch_rput: mp=%p fp=%p sctp=%p\n", (void *)mp,
1676Sjpk	    (void *)fp, (void *)sctp));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	gotdata = 0;
0Sstevel@tonic-gate	trysend = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	now = lbolt64;
0Sstevel@tonic-gate	/* Process the chunks */
0Sstevel@tonic-gate	do {
0Sstevel@tonic-gate		dprint(3, ("sctp_dispatch_rput: state=%d, chunk id=%d\n",
0Sstevel@tonic-gate		    sctp->sctp_state, (int)(ch->sch_id)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (ch->sch_id == CHUNK_ABORT) {
0Sstevel@tonic-gate			if (sctph->sh_verf != sctp->sctp_lvtag &&
0Sstevel@tonic-gate			    sctph->sh_verf != sctp->sctp_fvtag) {
0Sstevel@tonic-gate				/* drop it */
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		switch (sctp->sctp_state) {
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_ESTABLISHED:
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_PENDING:
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_SENT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_DATA:
0Sstevel@tonic-gate				/* 0-length data chunks are not allowed */
0Sstevel@tonic-gate				if (ntohs(ch->sch_len) == sizeof (*sdc)) {
0Sstevel@tonic-gate					sdc = (sctp_data_hdr_t *)ch;
0Sstevel@tonic-gate					tsn = sdc->sdh_tsn;
0Sstevel@tonic-gate					sctp_send_abort(sctp, sctp->sctp_fvtag,
0Sstevel@tonic-gate					    SCTP_ERR_NO_USR_DATA, (char *)&tsn,
0Sstevel@tonic-gate					    sizeof (tsn), mp, 0, B_FALSE);
0Sstevel@tonic-gate					sctp_assoc_event(sctp, SCTP_COMM_LOST,
0Sstevel@tonic-gate					    0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, ECONNABORTED);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp->sctp_lastdata = fp;
0Sstevel@tonic-gate				sctp_data_chunk(sctp, ch, mp, &dups, fp, &ipp);
0Sstevel@tonic-gate				gotdata = 1;
0Sstevel@tonic-gate				/* Restart shutdown timer if shutting down */
0Sstevel@tonic-gate				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * If we have exceeded our max
0Sstevel@tonic-gate					 * wait bound for waiting for a
0Sstevel@tonic-gate					 * shutdown ack from the peer,
0Sstevel@tonic-gate					 * abort the association.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate					if (sctp_shutack_wait_bound != 0 &&
0Sstevel@tonic-gate					    TICK_TO_MSEC(now -
0Sstevel@tonic-gate					    sctp->sctp_out_time) >
0Sstevel@tonic-gate					    sctp_shutack_wait_bound) {
0Sstevel@tonic-gate						sctp_send_abort(sctp,
0Sstevel@tonic-gate						    sctp->sctp_fvtag, 0, NULL,
0Sstevel@tonic-gate						    0, mp, 0, B_FALSE);
0Sstevel@tonic-gate						sctp_assoc_event(sctp,
0Sstevel@tonic-gate						    SCTP_COMM_LOST, 0, NULL);
0Sstevel@tonic-gate						sctp_clean_death(sctp,
0Sstevel@tonic-gate						    ECONNABORTED);
0Sstevel@tonic-gate						goto done;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SACK:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Peer is real and alive if it can ack our
0Sstevel@tonic-gate				 * data.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				trysend = sctp_got_sack(sctp, ch);
852Svi117747				if (trysend < 0) {
852Svi117747					sctp_send_abort(sctp, sctph->sh_verf,
852Svi117747					    0, NULL, 0, mp, 0, B_FALSE);
852Svi117747					sctp_assoc_event(sctp,
852Svi117747					    SCTP_COMM_LOST, 0, NULL);
852Svi117747					sctp_clean_death(sctp,
852Svi117747					    ECONNABORTED);
852Svi117747					goto done;
852Svi117747				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate				sctp_return_heartbeat(sctp, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT_ACK:
0Sstevel@tonic-gate				sctp_process_heartbeat(sctp, ch);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate				sctp_shutdown_event(sctp);
0Sstevel@tonic-gate				trysend = sctp_shutdown_received(sctp, ch,
1735Skcpoon				    B_FALSE, B_FALSE, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate					sctp_shutdown_complete(sctp);
0Sstevel@tonic-gate					BUMP_MIB(&sctp_mib, sctpShutdowns);
0Sstevel@tonic-gate					sctp_assoc_event(sctp,
0Sstevel@tonic-gate					    SCTP_SHUTDOWN_COMP, 0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT: {
0Sstevel@tonic-gate				sctp_saddr_ipif_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Ignore if delete pending */
852Svi117747				sp = sctp_saddr_lookup(sctp, &dst, 0);
0Sstevel@tonic-gate				ASSERT(sp != NULL);
0Sstevel@tonic-gate				if (sp->saddr_ipif_delete_pending) {
0Sstevel@tonic-gate					BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNRESET);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_INIT:
2776Skp158701				sctp_send_initack(sctp, sctph, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
0Sstevel@tonic-gate				    sctph, &recv_adaption, NULL) != -1) {
0Sstevel@tonic-gate					sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate					sctp_assoc_event(sctp, SCTP_RESTART,
0Sstevel@tonic-gate					    0, NULL);
0Sstevel@tonic-gate					if (recv_adaption) {
0Sstevel@tonic-gate						sctp->sctp_recv_adaption = 1;
0Sstevel@tonic-gate						sctp_adaption_event(sctp);
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					BUMP_MIB(&sctp_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ERROR: {
0Sstevel@tonic-gate				int error;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				error = sctp_handle_error(sctp, sctph, ch, mp);
0Sstevel@tonic-gate				if (error != 0) {
3314Skcpoon					sctp_assoc_event(sctp, SCTP_COMM_LOST,
3314Skcpoon					    0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, error);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_ASCONF:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp_input_asconf(sctp, ch, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ASCONF_ACK:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				sctp_input_asconf_ack(sctp, ch, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_FORWARD_TSN:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp->sctp_lastdata = fp;
0Sstevel@tonic-gate				sctp_process_forward_tsn(sctp, ch, fp, &ipp);
0Sstevel@tonic-gate				gotdata = 1;
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_LISTEN:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_INIT:
2776Skp158701				sctp_send_initack(sctp, sctph, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE: {
0Sstevel@tonic-gate				sctp_t *eager;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
0Sstevel@tonic-gate				    sctph, &recv_adaption, &peer_src) == -1) {
0Sstevel@tonic-gate					BUMP_MIB(&sctp_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * The cookie is good; ensure that
0Sstevel@tonic-gate				 * the peer used the verification
0Sstevel@tonic-gate				 * tag from the init ack in the header.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (iack->sic_inittag != sctph->sh_verf)
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				eager = sctp_conn_request(sctp, mp, ifindex,
0Sstevel@tonic-gate				    ip_hdr_len, iack, ipsec_mp);
0Sstevel@tonic-gate				if (eager == NULL) {
0Sstevel@tonic-gate					sctp_send_abort(sctp, sctph->sh_verf,
0Sstevel@tonic-gate					    SCTP_ERR_NO_RESOURCES, NULL, 0, mp,
0Sstevel@tonic-gate					    0, B_FALSE);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * If there were extra chunks
0Sstevel@tonic-gate				 * bundled with the cookie,
0Sstevel@tonic-gate				 * they must be processed
0Sstevel@tonic-gate				 * on the eager's queue. We
0Sstevel@tonic-gate				 * accomplish this by refeeding
0Sstevel@tonic-gate				 * the whole packet into the
0Sstevel@tonic-gate				 * state machine on the right
0Sstevel@tonic-gate				 * q. The packet (mp) gets
0Sstevel@tonic-gate				 * there via the eager's
0Sstevel@tonic-gate				 * cookie_mp field (overloaded
0Sstevel@tonic-gate				 * with the active open role).
0Sstevel@tonic-gate				 * This is picked up when
0Sstevel@tonic-gate				 * processing the null bind
0Sstevel@tonic-gate				 * request put on the eager's
0Sstevel@tonic-gate				 * q by sctp_accept(). We must
0Sstevel@tonic-gate				 * first revert the cookie
0Sstevel@tonic-gate				 * chunk's length field to network
0Sstevel@tonic-gate				 * byteorder so it can be
0Sstevel@tonic-gate				 * properly reprocessed on the
0Sstevel@tonic-gate				 * eager's queue.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpPassiveEstab);
0Sstevel@tonic-gate				if (mlen > ntohs(ch->sch_len)) {
0Sstevel@tonic-gate					eager->sctp_cookie_mp = dupb(mp);
1676Sjpk					mblk_setcred(eager->sctp_cookie_mp,
1676Sjpk					    CONN_CRED(eager->sctp_connp));
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * If no mem, just let
0Sstevel@tonic-gate					 * the peer retransmit.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_assoc_event(eager, SCTP_COMM_UP, 0, NULL);
0Sstevel@tonic-gate				if (recv_adaption) {
0Sstevel@tonic-gate					eager->sctp_recv_adaption = 1;
0Sstevel@tonic-gate					eager->sctp_rx_adaption_code =
0Sstevel@tonic-gate					    sctp->sctp_rx_adaption_code;
0Sstevel@tonic-gate					sctp_adaption_event(eager);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				eager->sctp_active = now;
0Sstevel@tonic-gate				sctp_send_cookie_ack(eager);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				wake_eager = B_TRUE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Process rest of the chunks with eager.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp = eager;
0Sstevel@tonic-gate				fp = sctp_lookup_faddr(sctp, &peer_src);
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Confirm peer's original source.  fp can
0Sstevel@tonic-gate				 * only be NULL if peer does not use the
0Sstevel@tonic-gate				 * original source as one of its addresses...
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (fp == NULL)
0Sstevel@tonic-gate					fp = sctp_lookup_faddr(sctp, &src);
0Sstevel@tonic-gate				else
0Sstevel@tonic-gate					sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Validate the peer addresses.  It also starts
0Sstevel@tonic-gate				 * the heartbeat timer.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/* Anything else is considered out-of-the-blue */
0Sstevel@tonic-gate			case CHUNK_ERROR:
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate			case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				sctp_send_abort(sctp, sctph->sh_verf, 0, NULL,
0Sstevel@tonic-gate				    0, mp, 0, B_TRUE);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_COOKIE_WAIT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_INIT_ACK:
0Sstevel@tonic-gate				sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, sctp->sctp_current);
0Sstevel@tonic-gate				sctp_send_cookie_echo(sctp, ch, mp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNREFUSED);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_INIT:
2776Skp158701				sctp_send_initack(sctp, sctph, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
0Sstevel@tonic-gate				    sctph, &recv_adaption, NULL) == -1) {
0Sstevel@tonic-gate					BUMP_MIB(&sctp_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate				sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
0Sstevel@tonic-gate				    sctp_set_ulp_prop(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpActiveEstab);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
0Sstevel@tonic-gate				if (recv_adaption) {
0Sstevel@tonic-gate					sctp->sctp_recv_adaption = 1;
0Sstevel@tonic-gate					sctp_adaption_event(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_COOKIE_ECHOED:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
0Sstevel@tonic-gate				    sctp_set_ulp_prop(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (sctp->sctp_unacked == 0)
0Sstevel@tonic-gate					sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpActiveEstab);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
0Sstevel@tonic-gate				sctp_adaption_event(sctp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNREFUSED);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
0Sstevel@tonic-gate				    sctph, &recv_adaption, NULL) == -1) {
0Sstevel@tonic-gate					BUMP_MIB(&sctp_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
0Sstevel@tonic-gate				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
0Sstevel@tonic-gate				    sctp_set_ulp_prop(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (sctp->sctp_unacked == 0)
0Sstevel@tonic-gate					sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpActiveEstab);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
0Sstevel@tonic-gate				if (recv_adaption) {
0Sstevel@tonic-gate					sctp->sctp_recv_adaption = 1;
0Sstevel@tonic-gate					sctp_adaption_event(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_INIT:
2776Skp158701				sctp_send_initack(sctp, sctph, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ERROR: {
0Sstevel@tonic-gate				sctp_parm_hdr_t *p;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				/* check for a stale cookie */
0Sstevel@tonic-gate				if (ntohs(ch->sch_len) >=
0Sstevel@tonic-gate				    (sizeof (*p) + sizeof (*ch)) +
0Sstevel@tonic-gate				    sizeof (uint32_t)) {
0Sstevel@tonic-gate
0Sstevel@tonic-gate					p = (sctp_parm_hdr_t *)(ch + 1);
0Sstevel@tonic-gate					if (p->sph_type ==
0Sstevel@tonic-gate					    htons(SCTP_ERR_STALE_COOKIE)) {
0Sstevel@tonic-gate						BUMP_MIB(&sctp_mib,
0Sstevel@tonic-gate						    sctpAborted);
0Sstevel@tonic-gate						sctp_error_event(sctp, ch);
3314Skcpoon						sctp_assoc_event(sctp,
3314Skcpoon						    SCTP_COMM_LOST, 0, NULL);
0Sstevel@tonic-gate						sctp_clean_death(sctp,
0Sstevel@tonic-gate						    ECONNREFUSED);
0Sstevel@tonic-gate						goto done;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate				sctp_return_heartbeat(sctp, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate			} /* switch (ch->sch_id) */
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_ACK_SENT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				/* Pass gathered wisdom to IP for keeping */
1735Skcpoon				sctp_update_ire(sctp);
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpShutdowns);
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
0Sstevel@tonic-gate				    NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Pass gathered wisdom to IP for keeping */
1735Skcpoon				sctp_update_ire(sctp);
0Sstevel@tonic-gate				sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate				sctp_shutdown_complete(sctp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				BUMP_MIB(&sctp_mib, sctpShutdowns);
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
0Sstevel@tonic-gate				    NULL);
0Sstevel@tonic-gate				sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				(void) sctp_shutdown_received(sctp, NULL,
1735Skcpoon				    B_TRUE, B_FALSE, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate				sctp_return_heartbeat(sctp, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_RECEIVED:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate				trysend = sctp_shutdown_received(sctp, ch,
1735Skcpoon				    B_FALSE, B_FALSE, fp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SACK:
0Sstevel@tonic-gate				trysend = sctp_got_sack(sctp, ch);
852Svi117747				if (trysend < 0) {
852Svi117747					sctp_send_abort(sctp, sctph->sh_verf,
852Svi117747					    0, NULL, 0, mp, 0, B_FALSE);
852Svi117747					sctp_assoc_event(sctp,
852Svi117747					    SCTP_COMM_LOST, 0, NULL);
852Svi117747					sctp_clean_death(sctp,
852Svi117747					    ECONNABORTED);
852Svi117747					goto done;
852Svi117747				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNRESET);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate				sctp_return_heartbeat(sctp, ch, mp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		default:
1932Svi117747			/*
1932Svi117747			 * The only remaining states are SCTPS_IDLE and
1932Svi117747			 * SCTPS_BOUND, and we should not be getting here
1932Svi117747			 * for these.
1932Svi117747			 */
1932Svi117747			ASSERT(0);
0Sstevel@tonic-gate		} /* switch (sctp->sctp_state) */
0Sstevel@tonic-gate
0Sstevel@tonic-gate		ch = sctp_next_chunk(ch, &mlen);
0Sstevel@tonic-gate		if (ch != NULL && !sctp_check_input(sctp, ch, mlen, 0))
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate	} while (ch != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Finished processing all chunks in packet */
0Sstevel@tonic-gate
0Sstevel@tonic-gatenomorechunks:
0Sstevel@tonic-gate	/* SACK if necessary */
0Sstevel@tonic-gate	if (gotdata) {
0Sstevel@tonic-gate		(sctp->sctp_sack_toggle)++;
0Sstevel@tonic-gate		sctp_sack(sctp, dups);
0Sstevel@tonic-gate		dups = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (!sctp->sctp_ack_timer_running) {
0Sstevel@tonic-gate			sctp->sctp_ack_timer_running = B_TRUE;
0Sstevel@tonic-gate			sctp_timer(sctp, sctp->sctp_ack_mp,
0Sstevel@tonic-gate			    MSEC_TO_TICK(sctp_deferred_ack_interval));
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (trysend) {
0Sstevel@tonic-gate		sctp_output(sctp);
0Sstevel@tonic-gate		if (sctp->sctp_cxmit_list != NULL)
0Sstevel@tonic-gate			sctp_wput_asconf(sctp, NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If there is unsent data, make sure a timer is running */
0Sstevel@tonic-gate	if (sctp->sctp_unsent > 0 && !sctp->sctp_current->timer_running) {
0Sstevel@tonic-gate		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
0Sstevel@tonic-gate		    sctp->sctp_current->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatedone:
0Sstevel@tonic-gate	if (dups != NULL)
0Sstevel@tonic-gate		freeb(dups);
0Sstevel@tonic-gate	if (ipsec_mp != NULL)
0Sstevel@tonic-gate		freeb(ipsec_mp);
0Sstevel@tonic-gate	freemsg(mp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (wake_eager) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * sctp points to newly created control block, need to
0Sstevel@tonic-gate		 * release it before exiting.  Before releasing it and
0Sstevel@tonic-gate		 * processing the sendq, need to grab a hold on it.
0Sstevel@tonic-gate		 * Otherwise, another thread can close it while processing
0Sstevel@tonic-gate		 * the sendq.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		SCTP_REFHOLD(sctp);
0Sstevel@tonic-gate		WAKE_SCTP(sctp);
0Sstevel@tonic-gate		sctp_process_sendq(sctp);
0Sstevel@tonic-gate		SCTP_REFRELE(sctp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Some amount of data got removed from rx q.
0Sstevel@tonic-gate * Check if we should send a window update.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * Due to way sctp_rwnd updates are made, ULP can give reports out-of-order.
0Sstevel@tonic-gate * To keep from dropping incoming data due to this, we only update
0Sstevel@tonic-gate * sctp_rwnd when if it's larger than what we've reported to peer earlier.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_recvd(sctp_t *sctp, int len)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	int32_t old, new;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(sctp != NULL);
0Sstevel@tonic-gate	RUN_SCTP(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (len < sctp->sctp_rwnd) {
0Sstevel@tonic-gate		WAKE_SCTP(sctp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT(sctp->sctp_rwnd >= sctp->sctp_rxqueued);
0Sstevel@tonic-gate	old = sctp->sctp_rwnd - sctp->sctp_rxqueued;
0Sstevel@tonic-gate	new = len - sctp->sctp_rxqueued;
0Sstevel@tonic-gate	sctp->sctp_rwnd = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_state >= SCTPS_ESTABLISHED &&
0Sstevel@tonic-gate	    ((old <= new >> 1) || (old < sctp->sctp_mss))) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		BUMP_MIB(&sctp_mib, sctpOutWinUpdate);
0Sstevel@tonic-gate		sctp_sack(sctp, NULL);
0Sstevel@tonic-gate		old = 1;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		old = 0;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	WAKE_SCTP(sctp);
0Sstevel@tonic-gate	if (old > 0) {
0Sstevel@tonic-gate		sctp_process_sendq(sctp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}