xref: /illumos-gate/usr/src/uts/common/inet/tcp/tcp.c (revision 2ad53042)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
25  * Copyright (c) 2013, 2017 by Delphix. All rights reserved.
26  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
27  * Copyright 2020 Joyent, Inc.
28  */
29 /* Copyright (c) 1990 Mentat Inc. */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/strsun.h>
34 #include <sys/strsubr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #define	_SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/timod.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/suntpi.h>
43 #include <sys/xti_inet.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/sdt.h>
47 #include <sys/vtrace.h>
48 #include <sys/kmem.h>
49 #include <sys/ethernet.h>
50 #include <sys/cpuvar.h>
51 #include <sys/dlpi.h>
52 #include <sys/pattr.h>
53 #include <sys/policy.h>
54 #include <sys/priv.h>
55 #include <sys/zone.h>
56 #include <sys/sunldi.h>
57 
58 #include <sys/errno.h>
59 #include <sys/signal.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sockio.h>
63 #include <sys/isa_defs.h>
64 #include <sys/md5.h>
65 #include <sys/random.h>
66 #include <sys/uio.h>
67 #include <sys/systm.h>
68 #include <netinet/in.h>
69 #include <netinet/tcp.h>
70 #include <netinet/ip6.h>
71 #include <netinet/icmp6.h>
72 #include <net/if.h>
73 #include <net/route.h>
74 #include <inet/ipsec_impl.h>
75 
76 #include <inet/common.h>
77 #include <inet/cc.h>
78 #include <inet/ip.h>
79 #include <inet/ip_impl.h>
80 #include <inet/ip6.h>
81 #include <inet/ip_ndp.h>
82 #include <inet/proto_set.h>
83 #include <inet/mib2.h>
84 #include <inet/optcom.h>
85 #include <inet/snmpcom.h>
86 #include <inet/kstatcom.h>
87 #include <inet/tcp.h>
88 #include <inet/tcp_impl.h>
89 #include <inet/tcp_cluster.h>
90 #include <inet/udp_impl.h>
91 #include <net/pfkeyv2.h>
92 #include <inet/ipdrop.h>
93 
94 #include <inet/ipclassifier.h>
95 #include <inet/ip_ire.h>
96 #include <inet/ip_ftable.h>
97 #include <inet/ip_if.h>
98 #include <inet/ipp_common.h>
99 #include <inet/ip_rts.h>
100 #include <inet/ip_netinfo.h>
101 #include <sys/squeue_impl.h>
102 #include <sys/squeue.h>
103 #include <sys/tsol/label.h>
104 #include <sys/tsol/tnet.h>
105 #include <rpc/pmap_prot.h>
106 #include <sys/callo.h>
107 
108 /*
109  * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)
110  *
111  * (Read the detailed design doc in PSARC case directory)
112  *
113  * The entire tcp state is contained in tcp_t and conn_t structure
114  * which are allocated in tandem using ipcl_conn_create() and passing
115  * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect
116  * the references on the tcp_t. The tcp_t structure is never compressed
117  * and packets always land on the correct TCP perimeter from the time
118  * eager is created till the time tcp_t dies (as such the old mentat
119  * TCP global queue is not used for detached state and no IPSEC checking
120  * is required). The global queue is still allocated to send out resets
121  * for connection which have no listeners and IP directly calls
122  * tcp_xmit_listeners_reset() which does any policy check.
123  *
124  * Protection and Synchronisation mechanism:
125  *
126  * The tcp data structure does not use any kind of lock for protecting
127  * its state but instead uses 'squeues' for mutual exclusion from various
128  * read and write side threads. To access a tcp member, the thread should
129  * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS,
130  * or SQ_NODRAIN). Since the squeues allow a direct function call, caller
131  * can pass any tcp function having prototype of edesc_t as argument
132  * (different from traditional STREAMs model where packets come in only
133  * designated entry points). The list of functions that can be directly
134  * called via squeue are listed before the usual function prototype.
135  *
136  * Referencing:
137  *
138  * TCP is MT-Hot and we use a reference based scheme to make sure that the
139  * tcp structure doesn't disappear when its needed. When the application
140  * creates an outgoing connection or accepts an incoming connection, we
141  * start out with 2 references on 'conn_ref'. One for TCP and one for IP.
142  * The IP reference is just a symbolic reference since ip_tcpclose()
143  * looks at tcp structure after tcp_close_output() returns which could
144  * have dropped the last TCP reference. So as long as the connection is
145  * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the
146  * conn_t. The classifier puts its own reference when the connection is
147  * inserted in listen or connected hash. Anytime a thread needs to enter
148  * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr
149  * on write side or by doing a classify on read side and then puts a
150  * reference on the conn before doing squeue_enter/tryenter/fill. For
151  * read side, the classifier itself puts the reference under fanout lock
152  * to make sure that tcp can't disappear before it gets processed. The
153  * squeue will drop this reference automatically so the called function
154  * doesn't have to do a DEC_REF.
155  *
156  * Opening a new connection:
157  *
158  * The outgoing connection open is pretty simple. tcp_open() does the
159  * work in creating the conn/tcp structure and initializing it. The
160  * squeue assignment is done based on the CPU the application
161  * is running on. So for outbound connections, processing is always done
162  * on application CPU which might be different from the incoming CPU
163  * being interrupted by the NIC. An optimal way would be to figure out
164  * the NIC <-> CPU binding at listen time, and assign the outgoing
165  * connection to the squeue attached to the CPU that will be interrupted
166  * for incoming packets (we know the NIC based on the bind IP address).
167  * This might seem like a problem if more data is going out but the
168  * fact is that in most cases the transmit is ACK driven transmit where
169  * the outgoing data normally sits on TCP's xmit queue waiting to be
170  * transmitted.
171  *
172  * Accepting a connection:
173  *
174  * This is a more interesting case because of various races involved in
175  * establishing a eager in its own perimeter. Read the meta comment on
176  * top of tcp_input_listener(). But briefly, the squeue is picked by
177  * ip_fanout based on the ring or the sender (if loopback).
178  *
179  * Closing a connection:
180  *
181  * The close is fairly straight forward. tcp_close() calls tcp_close_output()
182  * via squeue to do the close and mark the tcp as detached if the connection
183  * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its
184  * reference but tcp_close() drop IP's reference always. So if tcp was
185  * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP
186  * and 1 because it is in classifier's connected hash. This is the condition
187  * we use to determine that its OK to clean up the tcp outside of squeue
188  * when time wait expires (check the ref under fanout and conn_lock and
189  * if it is 2, remove it from fanout hash and kill it).
190  *
191  * Although close just drops the necessary references and marks the
192  * tcp_detached state, tcp_close needs to know the tcp_detached has been
193  * set (under squeue) before letting the STREAM go away (because a
194  * inbound packet might attempt to go up the STREAM while the close
195  * has happened and tcp_detached is not set). So a special lock and
196  * flag is used along with a condition variable (tcp_closelock, tcp_closed,
197  * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked
198  * tcp_detached.
199  *
200  * Special provisions and fast paths:
201  *
202  * We make special provisions for sockfs by marking tcp_issocket
203  * whenever we have only sockfs on top of TCP. This allows us to skip
204  * putting the tcp in acceptor hash since a sockfs listener can never
205  * become acceptor and also avoid allocating a tcp_t for acceptor STREAM
206  * since eager has already been allocated and the accept now happens
207  * on acceptor STREAM. There is a big blob of comment on top of
208  * tcp_input_listener explaining the new accept. When socket is POP'd,
209  * sockfs sends us an ioctl to mark the fact and we go back to old
210  * behaviour. Once tcp_issocket is unset, its never set for the
211  * life of that connection.
212  *
213  * IPsec notes :
214  *
215  * Since a packet is always executed on the correct TCP perimeter
216  * all IPsec processing is defered to IP including checking new
217  * connections and setting IPSEC policies for new connection. The
218  * only exception is tcp_xmit_listeners_reset() which is called
219  * directly from IP and needs to policy check to see if TH_RST
220  * can be sent out.
221  */
222 
223 /*
224  * Values for squeue switch:
225  * 1: SQ_NODRAIN
226  * 2: SQ_PROCESS
227  * 3: SQ_FILL
228  */
229 int tcp_squeue_wput = 2;	/* /etc/systems */
230 int tcp_squeue_flag;
231 
232 /*
233  * To prevent memory hog, limit the number of entries in tcp_free_list
234  * to 1% of available memory / number of cpus
235  */
236 uint_t tcp_free_list_max_cnt = 0;
237 
238 #define	TIDUSZ	4096	/* transport interface data unit size */
239 
240 /*
241  * Size of acceptor hash list.  It has to be a power of 2 for hashing.
242  */
243 #define	TCP_ACCEPTOR_FANOUT_SIZE		512
244 
245 #ifdef	_ILP32
246 #define	TCP_ACCEPTOR_HASH(accid)					\
247 		(((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
248 #else
249 #define	TCP_ACCEPTOR_HASH(accid)					\
250 		((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
251 #endif	/* _ILP32 */
252 
253 /*
254  * Minimum number of connections which can be created per listener.  Used
255  * when the listener connection count is in effect.
256  */
257 static uint32_t tcp_min_conn_listener = 2;
258 
259 uint32_t tcp_early_abort = 30;
260 
261 /* TCP Timer control structure */
262 typedef struct tcpt_s {
263 	pfv_t	tcpt_pfv;	/* The routine we are to call */
264 	tcp_t	*tcpt_tcp;	/* The parameter we are to pass in */
265 } tcpt_t;
266 
267 /*
268  * Functions called directly via squeue having a prototype of edesc_t.
269  */
270 void		tcp_input_data(void *arg, mblk_t *mp, void *arg2,
271     ip_recv_attr_t *ira);
272 static void	tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2,
273     ip_recv_attr_t *dummy);
274 
275 
276 /* Prototype for TCP functions */
277 static void	tcp_random_init(void);
278 int		tcp_random(void);
279 static int	tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp,
280 		    in_port_t dstport, uint_t srcid);
281 static int	tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp,
282 		    in_port_t dstport, uint32_t flowinfo,
283 		    uint_t srcid, uint32_t scope_id);
284 static void	tcp_iss_init(tcp_t *tcp);
285 static void	tcp_reinit(tcp_t *tcp);
286 static void	tcp_reinit_values(tcp_t *tcp);
287 
288 static int	tcp_wsrv(queue_t *q);
289 static void	tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa);
290 static void	tcp_update_zcopy(tcp_t *tcp);
291 static void	tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t,
292     ixa_notify_arg_t);
293 static void	*tcp_stack_init(netstackid_t stackid, netstack_t *ns);
294 static void	tcp_stack_fini(netstackid_t stackid, void *arg);
295 
296 static int	tcp_squeue_switch(int);
297 
298 static int	tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t);
299 static int	tcp_openv4(queue_t *, dev_t *, int, int, cred_t *);
300 static int	tcp_openv6(queue_t *, dev_t *, int, int, cred_t *);
301 
302 static void	tcp_squeue_add(squeue_t *);
303 
304 struct module_info tcp_rinfo =  {
305 	TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER
306 };
307 
308 static struct module_info tcp_winfo =  {
309 	TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16
310 };
311 
312 /*
313  * Entry points for TCP as a device. The normal case which supports
314  * the TCP functionality.
315  * We have separate open functions for the /dev/tcp and /dev/tcp6 devices.
316  */
317 struct qinit tcp_rinitv4 = {
318 	NULL, tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo
319 };
320 
321 struct qinit tcp_rinitv6 = {
322 	NULL, tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo
323 };
324 
325 struct qinit tcp_winit = {
326 	tcp_wput, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
327 };
328 
329 /* Initial entry point for TCP in socket mode. */
330 struct qinit tcp_sock_winit = {
331 	tcp_wput_sock, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
332 };
333 
334 /* TCP entry point during fallback */
335 struct qinit tcp_fallback_sock_winit = {
336 	tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo
337 };
338 
339 /*
340  * Entry points for TCP as a acceptor STREAM opened by sockfs when doing
341  * an accept. Avoid allocating data structures since eager has already
342  * been created.
343  */
344 struct qinit tcp_acceptor_rinit = {
345 	NULL, tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo
346 };
347 
348 struct qinit tcp_acceptor_winit = {
349 	tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo
350 };
351 
352 /* For AF_INET aka /dev/tcp */
353 struct streamtab tcpinfov4 = {
354 	&tcp_rinitv4, &tcp_winit
355 };
356 
357 /* For AF_INET6 aka /dev/tcp6 */
358 struct streamtab tcpinfov6 = {
359 	&tcp_rinitv6, &tcp_winit
360 };
361 
362 /*
363  * Following assumes TPI alignment requirements stay along 32 bit
364  * boundaries
365  */
366 #define	ROUNDUP32(x) \
367 	(((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1))
368 
369 /* Template for response to info request. */
370 struct T_info_ack tcp_g_t_info_ack = {
371 	T_INFO_ACK,		/* PRIM_type */
372 	0,			/* TSDU_size */
373 	T_INFINITE,		/* ETSDU_size */
374 	T_INVALID,		/* CDATA_size */
375 	T_INVALID,		/* DDATA_size */
376 	sizeof (sin_t),		/* ADDR_size */
377 	0,			/* OPT_size - not initialized here */
378 	TIDUSZ,			/* TIDU_size */
379 	T_COTS_ORD,		/* SERV_type */
380 	TCPS_IDLE,		/* CURRENT_state */
381 	(XPG4_1|EXPINLINE)	/* PROVIDER_flag */
382 };
383 
384 struct T_info_ack tcp_g_t_info_ack_v6 = {
385 	T_INFO_ACK,		/* PRIM_type */
386 	0,			/* TSDU_size */
387 	T_INFINITE,		/* ETSDU_size */
388 	T_INVALID,		/* CDATA_size */
389 	T_INVALID,		/* DDATA_size */
390 	sizeof (sin6_t),	/* ADDR_size */
391 	0,			/* OPT_size - not initialized here */
392 	TIDUSZ,		/* TIDU_size */
393 	T_COTS_ORD,		/* SERV_type */
394 	TCPS_IDLE,		/* CURRENT_state */
395 	(XPG4_1|EXPINLINE)	/* PROVIDER_flag */
396 };
397 
398 /*
399  * TCP tunables related declarations. Definitions are in tcp_tunables.c
400  */
401 extern mod_prop_info_t tcp_propinfo_tbl[];
402 extern int tcp_propinfo_count;
403 
404 #define	IS_VMLOANED_MBLK(mp) \
405 	(((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0)
406 
407 uint32_t do_tcpzcopy = 1;		/* 0: disable, 1: enable, 2: force */
408 
409 /*
410  * Forces all connections to obey the value of the tcps_maxpsz_multiplier
411  * tunable settable via NDD.  Otherwise, the per-connection behavior is
412  * determined dynamically during tcp_set_destination(), which is the default.
413  */
414 boolean_t tcp_static_maxpsz = B_FALSE;
415 
416 /*
417  * If the receive buffer size is changed, this function is called to update
418  * the upper socket layer on the new delayed receive wake up threshold.
419  */
420 static void
tcp_set_recv_threshold(tcp_t * tcp,uint32_t new_rcvthresh)421 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh)
422 {
423 	uint32_t default_threshold = SOCKET_RECVHIWATER >> 3;
424 
425 	if (IPCL_IS_NONSTR(tcp->tcp_connp)) {
426 		conn_t *connp = tcp->tcp_connp;
427 		struct sock_proto_props sopp;
428 
429 		/*
430 		 * only increase rcvthresh upto default_threshold
431 		 */
432 		if (new_rcvthresh > default_threshold)
433 			new_rcvthresh = default_threshold;
434 
435 		sopp.sopp_flags = SOCKOPT_RCVTHRESH;
436 		sopp.sopp_rcvthresh = new_rcvthresh;
437 
438 		(*connp->conn_upcalls->su_set_proto_props)
439 		    (connp->conn_upper_handle, &sopp);
440 	}
441 }
442 
443 /*
444  * Figure out the value of window scale opton.  Note that the rwnd is
445  * ASSUMED to be rounded up to the nearest MSS before the calculation.
446  * We cannot find the scale value and then do a round up of tcp_rwnd
447  * because the scale value may not be correct after that.
448  *
449  * Set the compiler flag to make this function inline.
450  */
451 void
tcp_set_ws_value(tcp_t * tcp)452 tcp_set_ws_value(tcp_t *tcp)
453 {
454 	int i;
455 	uint32_t rwnd = tcp->tcp_rwnd;
456 
457 	for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT;
458 	    i++, rwnd >>= 1)
459 		;
460 	tcp->tcp_rcv_ws = i;
461 }
462 
463 /*
464  * Remove cached/latched IPsec references.
465  */
466 void
tcp_ipsec_cleanup(tcp_t * tcp)467 tcp_ipsec_cleanup(tcp_t *tcp)
468 {
469 	conn_t		*connp = tcp->tcp_connp;
470 
471 	ASSERT(connp->conn_flags & IPCL_TCPCONN);
472 
473 	if (connp->conn_latch != NULL) {
474 		IPLATCH_REFRELE(connp->conn_latch);
475 		connp->conn_latch = NULL;
476 	}
477 	if (connp->conn_latch_in_policy != NULL) {
478 		IPPOL_REFRELE(connp->conn_latch_in_policy);
479 		connp->conn_latch_in_policy = NULL;
480 	}
481 	if (connp->conn_latch_in_action != NULL) {
482 		IPACT_REFRELE(connp->conn_latch_in_action);
483 		connp->conn_latch_in_action = NULL;
484 	}
485 	if (connp->conn_policy != NULL) {
486 		IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
487 		connp->conn_policy = NULL;
488 	}
489 }
490 
491 /*
492  * Cleaup before placing on free list.
493  * Disassociate from the netstack/tcp_stack_t since the freelist
494  * is per squeue and not per netstack.
495  */
496 void
tcp_cleanup(tcp_t * tcp)497 tcp_cleanup(tcp_t *tcp)
498 {
499 	mblk_t		*mp;
500 	conn_t		*connp = tcp->tcp_connp;
501 	tcp_stack_t	*tcps = tcp->tcp_tcps;
502 	netstack_t	*ns = tcps->tcps_netstack;
503 	mblk_t		*tcp_rsrv_mp;
504 
505 	tcp_bind_hash_remove(tcp);
506 
507 	/* Cleanup that which needs the netstack first */
508 	tcp_ipsec_cleanup(tcp);
509 	ixa_cleanup(connp->conn_ixa);
510 
511 	if (connp->conn_ht_iphc != NULL) {
512 		kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
513 		connp->conn_ht_iphc = NULL;
514 		connp->conn_ht_iphc_allocated = 0;
515 		connp->conn_ht_iphc_len = 0;
516 		connp->conn_ht_ulp = NULL;
517 		connp->conn_ht_ulp_len = 0;
518 		tcp->tcp_ipha = NULL;
519 		tcp->tcp_ip6h = NULL;
520 		tcp->tcp_tcpha = NULL;
521 	}
522 
523 	/* We clear any IP_OPTIONS and extension headers */
524 	ip_pkt_free(&connp->conn_xmit_ipp);
525 
526 	tcp_free(tcp);
527 
528 	/*
529 	 * Since we will bzero the entire structure, we need to
530 	 * remove it and reinsert it in global hash list. We
531 	 * know the walkers can't get to this conn because we
532 	 * had set CONDEMNED flag earlier and checked reference
533 	 * under conn_lock so walker won't pick it and when we
534 	 * go the ipcl_globalhash_remove() below, no walker
535 	 * can get to it.
536 	 */
537 	ipcl_globalhash_remove(connp);
538 
539 	/* Save some state */
540 	mp = tcp->tcp_timercache;
541 
542 	tcp_rsrv_mp = tcp->tcp_rsrv_mp;
543 
544 	if (connp->conn_cred != NULL) {
545 		crfree(connp->conn_cred);
546 		connp->conn_cred = NULL;
547 	}
548 	ipcl_conn_cleanup(connp);
549 	connp->conn_flags = IPCL_TCPCONN;
550 
551 	/*
552 	 * Now it is safe to decrement the reference counts.
553 	 * This might be the last reference on the netstack
554 	 * in which case it will cause the freeing of the IP Instance.
555 	 */
556 	connp->conn_netstack = NULL;
557 	connp->conn_ixa->ixa_ipst = NULL;
558 	netstack_rele(ns);
559 	ASSERT(tcps != NULL);
560 	tcp->tcp_tcps = NULL;
561 
562 	bzero(tcp, sizeof (tcp_t));
563 
564 	/* restore the state */
565 	tcp->tcp_timercache = mp;
566 
567 	tcp->tcp_rsrv_mp = tcp_rsrv_mp;
568 
569 	tcp->tcp_connp = connp;
570 
571 	ASSERT(connp->conn_tcp == tcp);
572 	ASSERT(connp->conn_flags & IPCL_TCPCONN);
573 	connp->conn_state_flags = CONN_INCIPIENT;
574 	ASSERT(connp->conn_proto == IPPROTO_TCP);
575 	ASSERT(connp->conn_ref == 1);
576 }
577 
578 /*
579  * Adapt to the information, such as rtt and rtt_sd, provided from the
580  * DCE and IRE maintained by IP.
581  *
582  * Checks for multicast and broadcast destination address.
583  * Returns zero if ok; an errno on failure.
584  *
585  * Note that the MSS calculation here is based on the info given in
586  * the DCE and IRE.  We do not do any calculation based on TCP options.  They
587  * will be handled in tcp_input_data() when TCP knows which options to use.
588  *
589  * Note on how TCP gets its parameters for a connection.
590  *
591  * When a tcp_t structure is allocated, it gets all the default parameters.
592  * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd,
593  * spipe, rpipe, ... from the route metrics.  Route metric overrides the
594  * default.
595  *
596  * An incoming SYN with a multicast or broadcast destination address is dropped
597  * in ip_fanout_v4/v6.
598  *
599  * An incoming SYN with a multicast or broadcast source address is always
600  * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in
601  * conn_connect.
602  * The same logic in tcp_set_destination also serves to
603  * reject an attempt to connect to a broadcast or multicast (destination)
604  * address.
605  */
606 int
tcp_set_destination(tcp_t * tcp)607 tcp_set_destination(tcp_t *tcp)
608 {
609 	uint32_t	mss_max;
610 	uint32_t	mss;
611 	boolean_t	tcp_detached = TCP_IS_DETACHED(tcp);
612 	conn_t		*connp = tcp->tcp_connp;
613 	tcp_stack_t	*tcps = tcp->tcp_tcps;
614 	iulp_t		uinfo;
615 	int		error;
616 	uint32_t	flags;
617 
618 	flags = IPDF_LSO | IPDF_ZCOPY;
619 	/*
620 	 * Make sure we have a dce for the destination to avoid dce_ident
621 	 * contention for connected sockets.
622 	 */
623 	flags |= IPDF_UNIQUE_DCE;
624 
625 	if (!tcps->tcps_ignore_path_mtu)
626 		connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
627 
628 	/* Use conn_lock to satify ASSERT; tcp is already serialized */
629 	mutex_enter(&connp->conn_lock);
630 	error = conn_connect(connp, &uinfo, flags);
631 	mutex_exit(&connp->conn_lock);
632 	if (error != 0)
633 		return (error);
634 
635 	error = tcp_build_hdrs(tcp);
636 	if (error != 0)
637 		return (error);
638 
639 	tcp->tcp_localnet = uinfo.iulp_localnet;
640 
641 	if (uinfo.iulp_rtt != 0) {
642 		tcp->tcp_rtt_sa = MSEC2NSEC(uinfo.iulp_rtt);
643 		tcp->tcp_rtt_sd = MSEC2NSEC(uinfo.iulp_rtt_sd);
644 		tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0);
645 	}
646 	if (uinfo.iulp_ssthresh != 0)
647 		tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh;
648 	else
649 		tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
650 	if (uinfo.iulp_spipe > 0) {
651 		connp->conn_sndbuf = MIN(uinfo.iulp_spipe,
652 		    tcps->tcps_max_buf);
653 		if (tcps->tcps_snd_lowat_fraction != 0) {
654 			connp->conn_sndlowat = connp->conn_sndbuf /
655 			    tcps->tcps_snd_lowat_fraction;
656 		}
657 		(void) tcp_maxpsz_set(tcp, B_TRUE);
658 	}
659 	/*
660 	 * Note that up till now, acceptor always inherits receive
661 	 * window from the listener.  But if there is a metrics
662 	 * associated with a host, we should use that instead of
663 	 * inheriting it from listener. Thus we need to pass this
664 	 * info back to the caller.
665 	 */
666 	if (uinfo.iulp_rpipe > 0) {
667 		tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe,
668 		    tcps->tcps_max_buf);
669 	}
670 
671 	if (uinfo.iulp_rtomax > 0) {
672 		tcp->tcp_second_timer_threshold =
673 		    uinfo.iulp_rtomax;
674 	}
675 
676 	/*
677 	 * Use the metric option settings, iulp_tstamp_ok and
678 	 * iulp_wscale_ok, only for active open. What this means
679 	 * is that if the other side uses timestamp or window
680 	 * scale option, TCP will also use those options. That
681 	 * is for passive open.  If the application sets a
682 	 * large window, window scale is enabled regardless of
683 	 * the value in iulp_wscale_ok.  This is the behavior
684 	 * since 2.6.  So we keep it.
685 	 * The only case left in passive open processing is the
686 	 * check for SACK.
687 	 * For ECN, it should probably be like SACK.  But the
688 	 * current value is binary, so we treat it like the other
689 	 * cases.  The metric only controls active open.For passive
690 	 * open, the ndd param, tcp_ecn_permitted, controls the
691 	 * behavior.
692 	 */
693 	if (!tcp_detached) {
694 		/*
695 		 * The if check means that the following can only
696 		 * be turned on by the metrics only IRE, but not off.
697 		 */
698 		if (uinfo.iulp_tstamp_ok)
699 			tcp->tcp_snd_ts_ok = B_TRUE;
700 		if (uinfo.iulp_wscale_ok)
701 			tcp->tcp_snd_ws_ok = B_TRUE;
702 		if (uinfo.iulp_sack == 2)
703 			tcp->tcp_snd_sack_ok = B_TRUE;
704 		if (uinfo.iulp_ecn_ok)
705 			tcp->tcp_ecn_ok = B_TRUE;
706 	} else {
707 		/*
708 		 * Passive open.
709 		 *
710 		 * As above, the if check means that SACK can only be
711 		 * turned on by the metric only IRE.
712 		 */
713 		if (uinfo.iulp_sack > 0) {
714 			tcp->tcp_snd_sack_ok = B_TRUE;
715 		}
716 	}
717 
718 	/*
719 	 * XXX Note that currently, iulp_mtu can be as small as 68
720 	 * because of PMTUd.  So tcp_mss may go to negative if combined
721 	 * length of all those options exceeds 28 bytes.  But because
722 	 * of the tcp_mss_min check below, we may not have a problem if
723 	 * tcp_mss_min is of a reasonable value.  The default is 1 so
724 	 * the negative problem still exists.  And the check defeats PMTUd.
725 	 * In fact, if PMTUd finds that the MSS should be smaller than
726 	 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min
727 	 * value.
728 	 *
729 	 * We do not deal with that now.  All those problems related to
730 	 * PMTUd will be fixed later.
731 	 */
732 	ASSERT(uinfo.iulp_mtu != 0);
733 	mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu;
734 
735 	/* Sanity check for MSS value. */
736 	if (connp->conn_ipversion == IPV4_VERSION)
737 		mss_max = tcps->tcps_mss_max_ipv4;
738 	else
739 		mss_max = tcps->tcps_mss_max_ipv6;
740 
741 	if (tcp->tcp_ipsec_overhead == 0)
742 		tcp->tcp_ipsec_overhead = conn_ipsec_length(connp);
743 
744 	mss -= tcp->tcp_ipsec_overhead;
745 
746 	if (mss < tcps->tcps_mss_min)
747 		mss = tcps->tcps_mss_min;
748 	if (mss > mss_max)
749 		mss = mss_max;
750 
751 	/* Note that this is the maximum MSS, excluding all options. */
752 	tcp->tcp_mss = mss;
753 
754 	/*
755 	 * Update the tcp connection with LSO capability.
756 	 */
757 	tcp_update_lso(tcp, connp->conn_ixa);
758 
759 	/*
760 	 * Initialize the ISS here now that we have the full connection ID.
761 	 * The RFC 1948 method of initial sequence number generation requires
762 	 * knowledge of the full connection ID before setting the ISS.
763 	 */
764 	tcp_iss_init(tcp);
765 
766 	tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local);
767 
768 	/*
769 	 * Make sure that conn is not marked incipient
770 	 * for incoming connections. A blind
771 	 * removal of incipient flag is cheaper than
772 	 * check and removal.
773 	 */
774 	mutex_enter(&connp->conn_lock);
775 	connp->conn_state_flags &= ~CONN_INCIPIENT;
776 	mutex_exit(&connp->conn_lock);
777 	return (0);
778 }
779 
780 /*
781  * tcp_clean_death / tcp_close_detached must not be called more than once
782  * on a tcp. Thus every function that potentially calls tcp_clean_death
783  * must check for the tcp state before calling tcp_clean_death.
784  * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper,
785  * tcp_timer_handler, all check for the tcp state.
786  */
787 /* ARGSUSED */
788 void
tcp_clean_death_wrapper(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)789 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2,
790     ip_recv_attr_t *dummy)
791 {
792 	tcp_t	*tcp = ((conn_t *)arg)->conn_tcp;
793 
794 	freemsg(mp);
795 	if (tcp->tcp_state > TCPS_BOUND)
796 		(void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT);
797 }
798 
799 /*
800  * We are dying for some reason.  Try to do it gracefully.  (May be called
801  * as writer.)
802  *
803  * Return -1 if the structure was not cleaned up (if the cleanup had to be
804  * done by a service procedure).
805  * TBD - Should the return value distinguish between the tcp_t being
806  * freed and it being reinitialized?
807  */
808 int
tcp_clean_death(tcp_t * tcp,int err)809 tcp_clean_death(tcp_t *tcp, int err)
810 {
811 	mblk_t	*mp;
812 	queue_t	*q;
813 	conn_t	*connp = tcp->tcp_connp;
814 	tcp_stack_t	*tcps = tcp->tcp_tcps;
815 
816 	if (tcp->tcp_fused)
817 		tcp_unfuse(tcp);
818 
819 	if (tcp->tcp_linger_tid != 0 &&
820 	    TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
821 		tcp_stop_lingering(tcp);
822 	}
823 
824 	ASSERT(tcp != NULL);
825 	ASSERT((connp->conn_family == AF_INET &&
826 	    connp->conn_ipversion == IPV4_VERSION) ||
827 	    (connp->conn_family == AF_INET6 &&
828 	    (connp->conn_ipversion == IPV4_VERSION ||
829 	    connp->conn_ipversion == IPV6_VERSION)));
830 
831 	if (TCP_IS_DETACHED(tcp)) {
832 		if (tcp->tcp_hard_binding) {
833 			/*
834 			 * Its an eager that we are dealing with. We close the
835 			 * eager but in case a conn_ind has already gone to the
836 			 * listener, let tcp_accept_finish() send a discon_ind
837 			 * to the listener and drop the last reference. If the
838 			 * listener doesn't even know about the eager i.e. the
839 			 * conn_ind hasn't gone up, blow away the eager and drop
840 			 * the last reference as well. If the conn_ind has gone
841 			 * up, state should be BOUND. tcp_accept_finish
842 			 * will figure out that the connection has received a
843 			 * RST and will send a DISCON_IND to the application.
844 			 */
845 			tcp_closei_local(tcp);
846 			if (!tcp->tcp_tconnind_started) {
847 				CONN_DEC_REF(connp);
848 			} else {
849 				tcp->tcp_state = TCPS_BOUND;
850 				DTRACE_TCP6(state__change, void, NULL,
851 				    ip_xmit_attr_t *, connp->conn_ixa,
852 				    void, NULL, tcp_t *, tcp, void, NULL,
853 				    int32_t, TCPS_CLOSED);
854 			}
855 		} else {
856 			tcp_close_detached(tcp);
857 		}
858 		return (0);
859 	}
860 
861 	TCP_STAT(tcps, tcp_clean_death_nondetached);
862 
863 	/*
864 	 * The connection is dead.  Decrement listener connection counter if
865 	 * necessary.
866 	 */
867 	if (tcp->tcp_listen_cnt != NULL)
868 		TCP_DECR_LISTEN_CNT(tcp);
869 
870 	/*
871 	 * When a connection is moved to TIME_WAIT state, the connection
872 	 * counter is already decremented.  So no need to decrement here
873 	 * again.  See SET_TIME_WAIT() macro.
874 	 */
875 	if (tcp->tcp_state >= TCPS_ESTABLISHED &&
876 	    tcp->tcp_state < TCPS_TIME_WAIT) {
877 		TCPS_CONN_DEC(tcps);
878 	}
879 
880 	q = connp->conn_rq;
881 
882 	/* Trash all inbound data */
883 	if (!IPCL_IS_NONSTR(connp)) {
884 		ASSERT(q != NULL);
885 		flushq(q, FLUSHALL);
886 	}
887 
888 	/*
889 	 * If we are at least part way open and there is error
890 	 * (err==0 implies no error)
891 	 * notify our client by a T_DISCON_IND.
892 	 */
893 	if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) {
894 		if (tcp->tcp_state >= TCPS_ESTABLISHED &&
895 		    !TCP_IS_SOCKET(tcp)) {
896 			/*
897 			 * Send M_FLUSH according to TPI. Because sockets will
898 			 * (and must) ignore FLUSHR we do that only for TPI
899 			 * endpoints and sockets in STREAMS mode.
900 			 */
901 			(void) putnextctl1(q, M_FLUSH, FLUSHR);
902 		}
903 		if (connp->conn_debug) {
904 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
905 			    "tcp_clean_death: discon err %d", err);
906 		}
907 		if (IPCL_IS_NONSTR(connp)) {
908 			/* Direct socket, use upcall */
909 			(*connp->conn_upcalls->su_disconnected)(
910 			    connp->conn_upper_handle, tcp->tcp_connid, err);
911 		} else {
912 			mp = mi_tpi_discon_ind(NULL, err, 0);
913 			if (mp != NULL) {
914 				putnext(q, mp);
915 			} else {
916 				if (connp->conn_debug) {
917 					(void) strlog(TCP_MOD_ID, 0, 1,
918 					    SL_ERROR|SL_TRACE,
919 					    "tcp_clean_death, sending M_ERROR");
920 				}
921 				(void) putnextctl1(q, M_ERROR, EPROTO);
922 			}
923 		}
924 		if (tcp->tcp_state <= TCPS_SYN_RCVD) {
925 			/* SYN_SENT or SYN_RCVD */
926 			TCPS_BUMP_MIB(tcps, tcpAttemptFails);
927 		} else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) {
928 			/* ESTABLISHED or CLOSE_WAIT */
929 			TCPS_BUMP_MIB(tcps, tcpEstabResets);
930 		}
931 	}
932 
933 	/*
934 	 * ESTABLISHED non-STREAMS eagers are not 'detached' because
935 	 * an upper handle is obtained when the SYN-ACK comes in. So it
936 	 * should receive the 'disconnected' upcall, but tcp_reinit should
937 	 * not be called since this is an eager.
938 	 */
939 	if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) {
940 		tcp_closei_local(tcp);
941 		tcp->tcp_state = TCPS_BOUND;
942 		DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
943 		    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
944 		    int32_t, TCPS_CLOSED);
945 		return (0);
946 	}
947 
948 	tcp_reinit(tcp);
949 	if (IPCL_IS_NONSTR(connp))
950 		(void) tcp_do_unbind(connp);
951 
952 	return (-1);
953 }
954 
955 /*
956  * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout
957  * to expire, stop the wait and finish the close.
958  */
959 void
tcp_stop_lingering(tcp_t * tcp)960 tcp_stop_lingering(tcp_t *tcp)
961 {
962 	clock_t	delta = 0;
963 	tcp_stack_t	*tcps = tcp->tcp_tcps;
964 	conn_t		*connp = tcp->tcp_connp;
965 
966 	tcp->tcp_linger_tid = 0;
967 	if (tcp->tcp_state > TCPS_LISTEN) {
968 		tcp_acceptor_hash_remove(tcp);
969 		mutex_enter(&tcp->tcp_non_sq_lock);
970 		if (tcp->tcp_flow_stopped) {
971 			tcp_clrqfull(tcp);
972 		}
973 		mutex_exit(&tcp->tcp_non_sq_lock);
974 
975 		if (tcp->tcp_timer_tid != 0) {
976 			delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
977 			tcp->tcp_timer_tid = 0;
978 		}
979 		/*
980 		 * Need to cancel those timers which will not be used when
981 		 * TCP is detached.  This has to be done before the conn_wq
982 		 * is cleared.
983 		 */
984 		tcp_timers_stop(tcp);
985 
986 		tcp->tcp_detached = B_TRUE;
987 		connp->conn_rq = NULL;
988 		connp->conn_wq = NULL;
989 
990 		if (tcp->tcp_state == TCPS_TIME_WAIT) {
991 			tcp_time_wait_append(tcp);
992 			TCP_DBGSTAT(tcps, tcp_detach_time_wait);
993 			goto finish;
994 		}
995 
996 		/*
997 		 * If delta is zero the timer event wasn't executed and was
998 		 * successfully canceled. In this case we need to restart it
999 		 * with the minimal delta possible.
1000 		 */
1001 		if (delta >= 0) {
1002 			tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
1003 			    delta ? delta : 1);
1004 		}
1005 	} else {
1006 		tcp_closei_local(tcp);
1007 		CONN_DEC_REF(connp);
1008 	}
1009 finish:
1010 	tcp->tcp_detached = B_TRUE;
1011 	connp->conn_rq = NULL;
1012 	connp->conn_wq = NULL;
1013 
1014 	/* Signal closing thread that it can complete close */
1015 	mutex_enter(&tcp->tcp_closelock);
1016 	tcp->tcp_closed = 1;
1017 	cv_signal(&tcp->tcp_closecv);
1018 	mutex_exit(&tcp->tcp_closelock);
1019 
1020 	/* If we have an upper handle (socket), release it */
1021 	if (IPCL_IS_NONSTR(connp)) {
1022 		sock_upcalls_t *upcalls = connp->conn_upcalls;
1023 		sock_upper_handle_t handle = connp->conn_upper_handle;
1024 
1025 		ASSERT(upcalls != NULL);
1026 		ASSERT(upcalls->su_closed != NULL);
1027 		ASSERT(handle != NULL);
1028 		/*
1029 		 * Set these to NULL first because closed() will free upper
1030 		 * structures.  Acquire conn_lock because an external caller
1031 		 * like conn_get_socket_info() will upcall if these are
1032 		 * non-NULL.
1033 		 */
1034 		mutex_enter(&connp->conn_lock);
1035 		connp->conn_upper_handle = NULL;
1036 		connp->conn_upcalls = NULL;
1037 		mutex_exit(&connp->conn_lock);
1038 		upcalls->su_closed(handle);
1039 	}
1040 }
1041 
1042 void
tcp_close_common(conn_t * connp,int flags)1043 tcp_close_common(conn_t *connp, int flags)
1044 {
1045 	tcp_t		*tcp = connp->conn_tcp;
1046 	mblk_t		*mp = &tcp->tcp_closemp;
1047 	boolean_t	conn_ioctl_cleanup_reqd = B_FALSE;
1048 	mblk_t		*bp;
1049 
1050 	ASSERT(connp->conn_ref >= 2);
1051 
1052 	/*
1053 	 * Mark the conn as closing. ipsq_pending_mp_add will not
1054 	 * add any mp to the pending mp list, after this conn has
1055 	 * started closing.
1056 	 */
1057 	mutex_enter(&connp->conn_lock);
1058 	connp->conn_state_flags |= CONN_CLOSING;
1059 	if (connp->conn_oper_pending_ill != NULL)
1060 		conn_ioctl_cleanup_reqd = B_TRUE;
1061 	CONN_INC_REF_LOCKED(connp);
1062 	mutex_exit(&connp->conn_lock);
1063 	tcp->tcp_closeflags = (uint8_t)flags;
1064 	ASSERT(connp->conn_ref >= 3);
1065 
1066 	/*
1067 	 * tcp_closemp_used is used below without any protection of a lock
1068 	 * as we don't expect any one else to use it concurrently at this
1069 	 * point otherwise it would be a major defect.
1070 	 */
1071 
1072 	if (mp->b_prev == NULL)
1073 		tcp->tcp_closemp_used = B_TRUE;
1074 	else
1075 		cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: "
1076 		    "connp %p tcp %p\n", (void *)connp, (void *)tcp);
1077 
1078 	TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15);
1079 
1080 	/*
1081 	 * Cleanup any queued ioctls here. This must be done before the wq/rq
1082 	 * are re-written by tcp_close_output().
1083 	 */
1084 	if (conn_ioctl_cleanup_reqd)
1085 		conn_ioctl_cleanup(connp);
1086 
1087 	/*
1088 	 * As CONN_CLOSING is set, no further ioctls should be passed down to
1089 	 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and
1090 	 * tcp_wput_iocdata). If the ioctl was queued on an ipsq,
1091 	 * conn_ioctl_cleanup should have found it and removed it. If the ioctl
1092 	 * was still in flight at the time, we wait for it here. See comments
1093 	 * for CONN_INC_IOCTLREF in ip.h for details.
1094 	 */
1095 	mutex_enter(&connp->conn_lock);
1096 	while (connp->conn_ioctlref > 0)
1097 		cv_wait(&connp->conn_cv, &connp->conn_lock);
1098 	ASSERT(connp->conn_ioctlref == 0);
1099 	ASSERT(connp->conn_oper_pending_ill == NULL);
1100 	mutex_exit(&connp->conn_lock);
1101 
1102 	SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp,
1103 	    NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1104 
1105 	/*
1106 	 * For non-STREAMS sockets, the normal case is that the conn makes
1107 	 * an upcall when it's finally closed, so there is no need to wait
1108 	 * in the protocol. But in case of SO_LINGER the thread sleeps here
1109 	 * so it can properly deal with the thread being interrupted.
1110 	 */
1111 	if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0)
1112 		goto nowait;
1113 
1114 	mutex_enter(&tcp->tcp_closelock);
1115 	while (!tcp->tcp_closed) {
1116 		if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) {
1117 			/*
1118 			 * The cv_wait_sig() was interrupted. We now do the
1119 			 * following:
1120 			 *
1121 			 * 1) If the endpoint was lingering, we allow this
1122 			 * to be interrupted by cancelling the linger timeout
1123 			 * and closing normally.
1124 			 *
1125 			 * 2) Revert to calling cv_wait()
1126 			 *
1127 			 * We revert to using cv_wait() to avoid an
1128 			 * infinite loop which can occur if the calling
1129 			 * thread is higher priority than the squeue worker
1130 			 * thread and is bound to the same cpu.
1131 			 */
1132 			if (connp->conn_linger && connp->conn_lingertime > 0) {
1133 				mutex_exit(&tcp->tcp_closelock);
1134 				/* Entering squeue, bump ref count. */
1135 				CONN_INC_REF(connp);
1136 				bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL);
1137 				SQUEUE_ENTER_ONE(connp->conn_sqp, bp,
1138 				    tcp_linger_interrupted, connp, NULL,
1139 				    tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1140 				mutex_enter(&tcp->tcp_closelock);
1141 			}
1142 			break;
1143 		}
1144 	}
1145 	while (!tcp->tcp_closed)
1146 		cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock);
1147 	mutex_exit(&tcp->tcp_closelock);
1148 
1149 	/*
1150 	 * In the case of listener streams that have eagers in the q or q0
1151 	 * we wait for the eagers to drop their reference to us. conn_rq and
1152 	 * conn_wq of the eagers point to our queues. By waiting for the
1153 	 * refcnt to drop to 1, we are sure that the eagers have cleaned
1154 	 * up their queue pointers and also dropped their references to us.
1155 	 *
1156 	 * For non-STREAMS sockets we do not have to wait here; the
1157 	 * listener will instead make a su_closed upcall when the last
1158 	 * reference is dropped.
1159 	 */
1160 	if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) {
1161 		mutex_enter(&connp->conn_lock);
1162 		while (connp->conn_ref != 1) {
1163 			cv_wait(&connp->conn_cv, &connp->conn_lock);
1164 		}
1165 		mutex_exit(&connp->conn_lock);
1166 	}
1167 
1168 nowait:
1169 	connp->conn_cpid = NOPID;
1170 }
1171 
1172 /*
1173  * Called by tcp_close() routine via squeue when lingering is
1174  * interrupted by a signal.
1175  */
1176 
1177 /* ARGSUSED */
1178 static void
tcp_linger_interrupted(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)1179 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1180 {
1181 	conn_t	*connp = (conn_t *)arg;
1182 	tcp_t	*tcp = connp->conn_tcp;
1183 
1184 	freeb(mp);
1185 	if (tcp->tcp_linger_tid != 0 &&
1186 	    TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
1187 		tcp_stop_lingering(tcp);
1188 		tcp->tcp_client_errno = EINTR;
1189 	}
1190 }
1191 
1192 /*
1193  * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp.
1194  * Some stream heads get upset if they see these later on as anything but NULL.
1195  */
1196 void
tcp_close_mpp(mblk_t ** mpp)1197 tcp_close_mpp(mblk_t **mpp)
1198 {
1199 	mblk_t	*mp;
1200 
1201 	if ((mp = *mpp) != NULL) {
1202 		do {
1203 			mp->b_next = NULL;
1204 			mp->b_prev = NULL;
1205 		} while ((mp = mp->b_cont) != NULL);
1206 
1207 		mp = *mpp;
1208 		*mpp = NULL;
1209 		freemsg(mp);
1210 	}
1211 }
1212 
1213 /* Do detached close. */
1214 void
tcp_close_detached(tcp_t * tcp)1215 tcp_close_detached(tcp_t *tcp)
1216 {
1217 	if (tcp->tcp_fused)
1218 		tcp_unfuse(tcp);
1219 
1220 	/*
1221 	 * Clustering code serializes TCP disconnect callbacks and
1222 	 * cluster tcp list walks by blocking a TCP disconnect callback
1223 	 * if a cluster tcp list walk is in progress. This ensures
1224 	 * accurate accounting of TCPs in the cluster code even though
1225 	 * the TCP list walk itself is not atomic.
1226 	 */
1227 	tcp_closei_local(tcp);
1228 	CONN_DEC_REF(tcp->tcp_connp);
1229 }
1230 
1231 /*
1232  * The tcp_t is going away. Remove it from all lists and set it
1233  * to TCPS_CLOSED. The freeing up of memory is deferred until
1234  * tcp_inactive. This is needed since a thread in tcp_rput might have
1235  * done a CONN_INC_REF on this structure before it was removed from the
1236  * hashes.
1237  */
1238 void
tcp_closei_local(tcp_t * tcp)1239 tcp_closei_local(tcp_t *tcp)
1240 {
1241 	conn_t		*connp = tcp->tcp_connp;
1242 	tcp_stack_t	*tcps = tcp->tcp_tcps;
1243 	int32_t		oldstate;
1244 
1245 	if (!TCP_IS_SOCKET(tcp))
1246 		tcp_acceptor_hash_remove(tcp);
1247 
1248 	/*
1249 	 * This can be called via tcp_time_wait_processing() if TCP gets a
1250 	 * SYN with sequence number outside the TIME-WAIT connection's
1251 	 * window.  So we need to check for TIME-WAIT state here as the
1252 	 * connection counter is already decremented.  See SET_TIME_WAIT()
1253 	 * macro
1254 	 */
1255 	if (tcp->tcp_state >= TCPS_ESTABLISHED &&
1256 	    tcp->tcp_state < TCPS_TIME_WAIT) {
1257 		TCPS_CONN_DEC(tcps);
1258 	}
1259 
1260 	/*
1261 	 * If we are an eager connection hanging off a listener that
1262 	 * hasn't formally accepted the connection yet, get off its
1263 	 * list and blow off any data that we have accumulated.
1264 	 */
1265 	if (tcp->tcp_listener != NULL) {
1266 		tcp_t	*listener = tcp->tcp_listener;
1267 		mutex_enter(&listener->tcp_eager_lock);
1268 		/*
1269 		 * tcp_tconnind_started == B_TRUE means that the
1270 		 * conn_ind has already gone to listener. At
1271 		 * this point, eager will be closed but we
1272 		 * leave it in listeners eager list so that
1273 		 * if listener decides to close without doing
1274 		 * accept, we can clean this up. In tcp_tli_accept
1275 		 * we take care of the case of accept on closed
1276 		 * eager.
1277 		 */
1278 		if (!tcp->tcp_tconnind_started) {
1279 			tcp_eager_unlink(tcp);
1280 			mutex_exit(&listener->tcp_eager_lock);
1281 			/*
1282 			 * We don't want to have any pointers to the
1283 			 * listener queue, after we have released our
1284 			 * reference on the listener
1285 			 */
1286 			ASSERT(tcp->tcp_detached);
1287 			connp->conn_rq = NULL;
1288 			connp->conn_wq = NULL;
1289 			CONN_DEC_REF(listener->tcp_connp);
1290 		} else {
1291 			mutex_exit(&listener->tcp_eager_lock);
1292 		}
1293 	}
1294 
1295 	/* Stop all the timers */
1296 	tcp_timers_stop(tcp);
1297 
1298 	if (tcp->tcp_state == TCPS_LISTEN) {
1299 		if (tcp->tcp_ip_addr_cache) {
1300 			kmem_free((void *)tcp->tcp_ip_addr_cache,
1301 			    IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
1302 			tcp->tcp_ip_addr_cache = NULL;
1303 		}
1304 	}
1305 
1306 	/* Decrement listerner connection counter if necessary. */
1307 	if (tcp->tcp_listen_cnt != NULL)
1308 		TCP_DECR_LISTEN_CNT(tcp);
1309 
1310 	mutex_enter(&tcp->tcp_non_sq_lock);
1311 	if (tcp->tcp_flow_stopped)
1312 		tcp_clrqfull(tcp);
1313 	mutex_exit(&tcp->tcp_non_sq_lock);
1314 
1315 	tcp_bind_hash_remove(tcp);
1316 	/*
1317 	 * If the tcp_time_wait_collector (which runs outside the squeue)
1318 	 * is trying to remove this tcp from the time wait list, we will
1319 	 * block in tcp_time_wait_remove while trying to acquire the
1320 	 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also
1321 	 * requires the ipcl_hash_remove to be ordered after the
1322 	 * tcp_time_wait_remove for the refcnt checks to work correctly.
1323 	 */
1324 	if (tcp->tcp_state == TCPS_TIME_WAIT)
1325 		(void) tcp_time_wait_remove(tcp, NULL);
1326 	CL_INET_DISCONNECT(connp);
1327 	ipcl_hash_remove(connp);
1328 	oldstate = tcp->tcp_state;
1329 	tcp->tcp_state = TCPS_CLOSED;
1330 	/* Need to probe before ixa_cleanup() is called */
1331 	DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1332 	    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
1333 	    int32_t, oldstate);
1334 	ixa_cleanup(connp->conn_ixa);
1335 
1336 	/*
1337 	 * Mark the conn as CONDEMNED
1338 	 */
1339 	mutex_enter(&connp->conn_lock);
1340 	connp->conn_state_flags |= CONN_CONDEMNED;
1341 	mutex_exit(&connp->conn_lock);
1342 
1343 	ASSERT(tcp->tcp_time_wait_next == NULL);
1344 	ASSERT(tcp->tcp_time_wait_prev == NULL);
1345 	ASSERT(tcp->tcp_time_wait_expire == 0);
1346 
1347 	tcp_ipsec_cleanup(tcp);
1348 }
1349 
1350 /*
1351  * tcp is dying (called from ipcl_conn_destroy and error cases).
1352  * Free the tcp_t in either case.
1353  */
1354 void
tcp_free(tcp_t * tcp)1355 tcp_free(tcp_t *tcp)
1356 {
1357 	mblk_t		*mp;
1358 	conn_t		*connp = tcp->tcp_connp;
1359 
1360 	ASSERT(tcp != NULL);
1361 	ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL);
1362 
1363 	connp->conn_rq = NULL;
1364 	connp->conn_wq = NULL;
1365 
1366 	tcp_close_mpp(&tcp->tcp_xmit_head);
1367 	tcp_close_mpp(&tcp->tcp_reass_head);
1368 	if (tcp->tcp_rcv_list != NULL) {
1369 		/* Free b_next chain */
1370 		tcp_close_mpp(&tcp->tcp_rcv_list);
1371 	}
1372 	if ((mp = tcp->tcp_urp_mp) != NULL) {
1373 		freemsg(mp);
1374 	}
1375 	if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1376 		freemsg(mp);
1377 	}
1378 
1379 	if (tcp->tcp_fused_sigurg_mp != NULL) {
1380 		ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1381 		freeb(tcp->tcp_fused_sigurg_mp);
1382 		tcp->tcp_fused_sigurg_mp = NULL;
1383 	}
1384 
1385 	if (tcp->tcp_ordrel_mp != NULL) {
1386 		ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1387 		freeb(tcp->tcp_ordrel_mp);
1388 		tcp->tcp_ordrel_mp = NULL;
1389 	}
1390 
1391 	TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
1392 	bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
1393 
1394 	if (tcp->tcp_hopopts != NULL) {
1395 		mi_free(tcp->tcp_hopopts);
1396 		tcp->tcp_hopopts = NULL;
1397 		tcp->tcp_hopoptslen = 0;
1398 	}
1399 	ASSERT(tcp->tcp_hopoptslen == 0);
1400 	if (tcp->tcp_dstopts != NULL) {
1401 		mi_free(tcp->tcp_dstopts);
1402 		tcp->tcp_dstopts = NULL;
1403 		tcp->tcp_dstoptslen = 0;
1404 	}
1405 	ASSERT(tcp->tcp_dstoptslen == 0);
1406 	if (tcp->tcp_rthdrdstopts != NULL) {
1407 		mi_free(tcp->tcp_rthdrdstopts);
1408 		tcp->tcp_rthdrdstopts = NULL;
1409 		tcp->tcp_rthdrdstoptslen = 0;
1410 	}
1411 	ASSERT(tcp->tcp_rthdrdstoptslen == 0);
1412 	if (tcp->tcp_rthdr != NULL) {
1413 		mi_free(tcp->tcp_rthdr);
1414 		tcp->tcp_rthdr = NULL;
1415 		tcp->tcp_rthdrlen = 0;
1416 	}
1417 	ASSERT(tcp->tcp_rthdrlen == 0);
1418 
1419 	/*
1420 	 * Following is really a blowing away a union.
1421 	 * It happens to have exactly two members of identical size
1422 	 * the following code is enough.
1423 	 */
1424 	tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1425 
1426 	/* Allow the CC algorithm to clean up after itself. */
1427 	if (tcp->tcp_cc_algo != NULL && tcp->tcp_cc_algo->cb_destroy != NULL)
1428 		tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv);
1429 
1430 	/*
1431 	 * If this is a non-STREAM socket still holding on to an upper
1432 	 * handle, release it. As a result of fallback we might also see
1433 	 * STREAMS based conns with upper handles, in which case there is
1434 	 * nothing to do other than clearing the field.
1435 	 */
1436 	if (connp->conn_upper_handle != NULL) {
1437 		sock_upcalls_t *upcalls = connp->conn_upcalls;
1438 		sock_upper_handle_t handle = connp->conn_upper_handle;
1439 
1440 		/*
1441 		 * Set these to NULL first because closed() will free upper
1442 		 * structures.  Acquire conn_lock because an external caller
1443 		 * like conn_get_socket_info() will upcall if these are
1444 		 * non-NULL.
1445 		 */
1446 		mutex_enter(&connp->conn_lock);
1447 		connp->conn_upper_handle = NULL;
1448 		connp->conn_upcalls = NULL;
1449 		mutex_exit(&connp->conn_lock);
1450 		if (IPCL_IS_NONSTR(connp)) {
1451 			ASSERT(upcalls != NULL);
1452 			ASSERT(upcalls->su_closed != NULL);
1453 			ASSERT(handle != NULL);
1454 			upcalls->su_closed(handle);
1455 			tcp->tcp_detached = B_TRUE;
1456 		}
1457 	}
1458 }
1459 
1460 /*
1461  * tcp_get_conn/tcp_free_conn
1462  *
1463  * tcp_get_conn is used to get a clean tcp connection structure.
1464  * It tries to reuse the connections put on the freelist by the
1465  * time_wait_collector failing which it goes to kmem_cache. This
1466  * way has two benefits compared to just allocating from and
1467  * freeing to kmem_cache.
1468  * 1) The time_wait_collector can free (which includes the cleanup)
1469  * outside the squeue. So when the interrupt comes, we have a clean
1470  * connection sitting in the freelist. Obviously, this buys us
1471  * performance.
1472  *
1473  * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener
1474  * has multiple disadvantages - tying up the squeue during alloc.
1475  * But allocating the conn/tcp in IP land is also not the best since
1476  * we can't check the 'q' and 'q0' which are protected by squeue and
1477  * blindly allocate memory which might have to be freed here if we are
1478  * not allowed to accept the connection. By using the freelist and
1479  * putting the conn/tcp back in freelist, we don't pay a penalty for
1480  * allocating memory without checking 'q/q0' and freeing it if we can't
1481  * accept the connection.
1482  *
1483  * Care should be taken to put the conn back in the same squeue's freelist
1484  * from which it was allocated. Best results are obtained if conn is
1485  * allocated from listener's squeue and freed to the same. Time wait
1486  * collector will free up the freelist is the connection ends up sitting
1487  * there for too long.
1488  */
1489 conn_t *
tcp_get_conn(void * arg,tcp_stack_t * tcps)1490 tcp_get_conn(void *arg, tcp_stack_t *tcps)
1491 {
1492 	tcp_t			*tcp = NULL;
1493 	conn_t			*connp = NULL;
1494 	squeue_t		*sqp = (squeue_t *)arg;
1495 	tcp_squeue_priv_t	*tcp_time_wait;
1496 	netstack_t		*ns;
1497 	mblk_t			*tcp_rsrv_mp = NULL;
1498 
1499 	tcp_time_wait =
1500 	    *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
1501 
1502 	mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1503 	tcp = tcp_time_wait->tcp_free_list;
1504 	ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0));
1505 	if (tcp != NULL) {
1506 		tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
1507 		tcp_time_wait->tcp_free_list_cnt--;
1508 		mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1509 		tcp->tcp_time_wait_next = NULL;
1510 		connp = tcp->tcp_connp;
1511 		connp->conn_flags |= IPCL_REUSED;
1512 
1513 		ASSERT(tcp->tcp_tcps == NULL);
1514 		ASSERT(connp->conn_netstack == NULL);
1515 		ASSERT(tcp->tcp_rsrv_mp != NULL);
1516 		ns = tcps->tcps_netstack;
1517 		netstack_hold(ns);
1518 		connp->conn_netstack = ns;
1519 		connp->conn_ixa->ixa_ipst = ns->netstack_ip;
1520 		tcp->tcp_tcps = tcps;
1521 		ipcl_globalhash_insert(connp);
1522 
1523 		connp->conn_ixa->ixa_notify_cookie = tcp;
1524 		ASSERT(connp->conn_ixa->ixa_notify == tcp_notify);
1525 		connp->conn_recv = tcp_input_data;
1526 		ASSERT(connp->conn_recvicmp == tcp_icmp_input);
1527 		ASSERT(connp->conn_verifyicmp == tcp_verifyicmp);
1528 		return (connp);
1529 	}
1530 	mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1531 	/*
1532 	 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until
1533 	 * this conn_t/tcp_t is freed at ipcl_conn_destroy().
1534 	 */
1535 	tcp_rsrv_mp = allocb(0, BPRI_HI);
1536 	if (tcp_rsrv_mp == NULL)
1537 		return (NULL);
1538 
1539 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP,
1540 	    tcps->tcps_netstack)) == NULL) {
1541 		freeb(tcp_rsrv_mp);
1542 		return (NULL);
1543 	}
1544 
1545 	tcp = connp->conn_tcp;
1546 	tcp->tcp_rsrv_mp = tcp_rsrv_mp;
1547 	mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL);
1548 
1549 	tcp->tcp_tcps = tcps;
1550 
1551 	connp->conn_recv = tcp_input_data;
1552 	connp->conn_recvicmp = tcp_icmp_input;
1553 	connp->conn_verifyicmp = tcp_verifyicmp;
1554 
1555 	/*
1556 	 * Register tcp_notify to listen to capability changes detected by IP.
1557 	 * This upcall is made in the context of the call to conn_ip_output
1558 	 * thus it is inside the squeue.
1559 	 */
1560 	connp->conn_ixa->ixa_notify = tcp_notify;
1561 	connp->conn_ixa->ixa_notify_cookie = tcp;
1562 
1563 	return (connp);
1564 }
1565 
1566 /*
1567  * Handle connect to IPv4 destinations, including connections for AF_INET6
1568  * sockets connecting to IPv4 mapped IPv6 destinations.
1569  * Returns zero if OK, a positive errno, or a negative TLI error.
1570  */
1571 static int
tcp_connect_ipv4(tcp_t * tcp,ipaddr_t * dstaddrp,in_port_t dstport,uint_t srcid)1572 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport,
1573     uint_t srcid)
1574 {
1575 	ipaddr_t	dstaddr = *dstaddrp;
1576 	uint16_t	lport;
1577 	conn_t		*connp = tcp->tcp_connp;
1578 	tcp_stack_t	*tcps = tcp->tcp_tcps;
1579 	int		error;
1580 
1581 	ASSERT(connp->conn_ipversion == IPV4_VERSION);
1582 
1583 	/* Check for attempt to connect to INADDR_ANY */
1584 	if (dstaddr == INADDR_ANY)  {
1585 		/*
1586 		 * SunOS 4.x and 4.3 BSD allow an application
1587 		 * to connect a TCP socket to INADDR_ANY.
1588 		 * When they do this, the kernel picks the
1589 		 * address of one interface and uses it
1590 		 * instead.  The kernel usually ends up
1591 		 * picking the address of the loopback
1592 		 * interface.  This is an undocumented feature.
1593 		 * However, we provide the same thing here
1594 		 * in order to have source and binary
1595 		 * compatibility with SunOS 4.x.
1596 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
1597 		 * generate the T_CONN_CON.
1598 		 */
1599 		dstaddr = htonl(INADDR_LOOPBACK);
1600 		*dstaddrp = dstaddr;
1601 	}
1602 
1603 	/* Handle __sin6_src_id if socket not bound to an IP address */
1604 	if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) {
1605 		if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1606 		    IPCL_ZONEID(connp), B_TRUE, tcps->tcps_netstack)) {
1607 			/* Mismatch - conn_laddr_v6 would be v6 address. */
1608 			return (EADDRNOTAVAIL);
1609 		}
1610 		connp->conn_saddr_v6 = connp->conn_laddr_v6;
1611 	}
1612 
1613 	IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6);
1614 	connp->conn_fport = dstport;
1615 
1616 	/*
1617 	 * At this point the remote destination address and remote port fields
1618 	 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1619 	 * have to see which state tcp was in so we can take appropriate action.
1620 	 */
1621 	if (tcp->tcp_state == TCPS_IDLE) {
1622 		/*
1623 		 * We support a quick connect capability here, allowing
1624 		 * clients to transition directly from IDLE to SYN_SENT
1625 		 * tcp_bindi will pick an unused port, insert the connection
1626 		 * in the bind hash and transition to BOUND state.
1627 		 */
1628 		lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1629 		    tcp, B_TRUE);
1630 		lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1631 		    B_FALSE, B_FALSE);
1632 		if (lport == 0)
1633 			return (-TNOADDR);
1634 	}
1635 
1636 	/*
1637 	 * Lookup the route to determine a source address and the uinfo.
1638 	 * Setup TCP parameters based on the metrics/DCE.
1639 	 */
1640 	error = tcp_set_destination(tcp);
1641 	if (error != 0)
1642 		return (error);
1643 
1644 	/*
1645 	 * Don't let an endpoint connect to itself.
1646 	 */
1647 	if (connp->conn_faddr_v4 == connp->conn_laddr_v4 &&
1648 	    connp->conn_fport == connp->conn_lport)
1649 		return (-TBADADDR);
1650 
1651 	tcp->tcp_state = TCPS_SYN_SENT;
1652 
1653 	return (ipcl_conn_insert_v4(connp));
1654 }
1655 
1656 /*
1657  * Handle connect to IPv6 destinations.
1658  * Returns zero if OK, a positive errno, or a negative TLI error.
1659  */
1660 static int
tcp_connect_ipv6(tcp_t * tcp,in6_addr_t * dstaddrp,in_port_t dstport,uint32_t flowinfo,uint_t srcid,uint32_t scope_id)1661 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport,
1662     uint32_t flowinfo, uint_t srcid, uint32_t scope_id)
1663 {
1664 	uint16_t	lport;
1665 	conn_t		*connp = tcp->tcp_connp;
1666 	tcp_stack_t	*tcps = tcp->tcp_tcps;
1667 	int		error;
1668 
1669 	ASSERT(connp->conn_family == AF_INET6);
1670 
1671 	/*
1672 	 * If we're here, it means that the destination address is a native
1673 	 * IPv6 address.  Return an error if conn_ipversion is not IPv6.  A
1674 	 * reason why it might not be IPv6 is if the socket was bound to an
1675 	 * IPv4-mapped IPv6 address.
1676 	 */
1677 	if (connp->conn_ipversion != IPV6_VERSION)
1678 		return (-TBADADDR);
1679 
1680 	/*
1681 	 * Interpret a zero destination to mean loopback.
1682 	 * Update the T_CONN_REQ (sin/sin6) since it is used to
1683 	 * generate the T_CONN_CON.
1684 	 */
1685 	if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp))
1686 		*dstaddrp = ipv6_loopback;
1687 
1688 	/* Handle __sin6_src_id if socket not bound to an IP address */
1689 	if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1690 		if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1691 		    IPCL_ZONEID(connp), B_FALSE, tcps->tcps_netstack)) {
1692 			/* Mismatch - conn_laddr_v6 would be v4-mapped. */
1693 			return (EADDRNOTAVAIL);
1694 		}
1695 		connp->conn_saddr_v6 = connp->conn_laddr_v6;
1696 	}
1697 
1698 	/*
1699 	 * Take care of the scope_id now.
1700 	 */
1701 	if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) {
1702 		connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1703 		connp->conn_ixa->ixa_scopeid = scope_id;
1704 	} else {
1705 		connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
1706 	}
1707 
1708 	connp->conn_flowinfo = flowinfo;
1709 	connp->conn_faddr_v6 = *dstaddrp;
1710 	connp->conn_fport = dstport;
1711 
1712 	/*
1713 	 * At this point the remote destination address and remote port fields
1714 	 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1715 	 * have to see which state tcp was in so we can take appropriate action.
1716 	 */
1717 	if (tcp->tcp_state == TCPS_IDLE) {
1718 		/*
1719 		 * We support a quick connect capability here, allowing
1720 		 * clients to transition directly from IDLE to SYN_SENT
1721 		 * tcp_bindi will pick an unused port, insert the connection
1722 		 * in the bind hash and transition to BOUND state.
1723 		 */
1724 		lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1725 		    tcp, B_TRUE);
1726 		lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1727 		    B_FALSE, B_FALSE);
1728 		if (lport == 0)
1729 			return (-TNOADDR);
1730 	}
1731 
1732 	/*
1733 	 * Lookup the route to determine a source address and the uinfo.
1734 	 * Setup TCP parameters based on the metrics/DCE.
1735 	 */
1736 	error = tcp_set_destination(tcp);
1737 	if (error != 0)
1738 		return (error);
1739 
1740 	/*
1741 	 * Don't let an endpoint connect to itself.
1742 	 */
1743 	if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) &&
1744 	    connp->conn_fport == connp->conn_lport)
1745 		return (-TBADADDR);
1746 
1747 	tcp->tcp_state = TCPS_SYN_SENT;
1748 
1749 	return (ipcl_conn_insert_v6(connp));
1750 }
1751 
1752 /*
1753  * Disconnect
1754  * Note that unlike other functions this returns a positive tli error
1755  * when it fails; it never returns an errno.
1756  */
1757 static int
tcp_disconnect_common(tcp_t * tcp,t_scalar_t seqnum)1758 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum)
1759 {
1760 	conn_t		*lconnp;
1761 	tcp_stack_t	*tcps = tcp->tcp_tcps;
1762 	conn_t		*connp = tcp->tcp_connp;
1763 
1764 	/*
1765 	 * Right now, upper modules pass down a T_DISCON_REQ to TCP,
1766 	 * when the stream is in BOUND state. Do not send a reset,
1767 	 * since the destination IP address is not valid, and it can
1768 	 * be the initialized value of all zeros (broadcast address).
1769 	 */
1770 	if (tcp->tcp_state <= TCPS_BOUND) {
1771 		if (connp->conn_debug) {
1772 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
1773 			    "tcp_disconnect: bad state, %d", tcp->tcp_state);
1774 		}
1775 		return (TOUTSTATE);
1776 	} else if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1777 		TCPS_CONN_DEC(tcps);
1778 	}
1779 
1780 	if (seqnum == -1 || tcp->tcp_conn_req_max == 0) {
1781 
1782 		/*
1783 		 * According to TPI, for non-listeners, ignore seqnum
1784 		 * and disconnect.
1785 		 * Following interpretation of -1 seqnum is historical
1786 		 * and implied TPI ? (TPI only states that for T_CONN_IND,
1787 		 * a valid seqnum should not be -1).
1788 		 *
1789 		 *	-1 means disconnect everything
1790 		 *	regardless even on a listener.
1791 		 */
1792 
1793 		int old_state = tcp->tcp_state;
1794 		ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1795 
1796 		/*
1797 		 * The connection can't be on the tcp_time_wait_head list
1798 		 * since it is not detached.
1799 		 */
1800 		ASSERT(tcp->tcp_time_wait_next == NULL);
1801 		ASSERT(tcp->tcp_time_wait_prev == NULL);
1802 		ASSERT(tcp->tcp_time_wait_expire == 0);
1803 		/*
1804 		 * If it used to be a listener, check to make sure no one else
1805 		 * has taken the port before switching back to LISTEN state.
1806 		 */
1807 		if (connp->conn_ipversion == IPV4_VERSION) {
1808 			lconnp = ipcl_lookup_listener_v4(connp->conn_lport,
1809 			    connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst);
1810 		} else {
1811 			uint_t ifindex = 0;
1812 
1813 			if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)
1814 				ifindex = connp->conn_ixa->ixa_scopeid;
1815 
1816 			/* Allow conn_bound_if listeners? */
1817 			lconnp = ipcl_lookup_listener_v6(connp->conn_lport,
1818 			    &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp),
1819 			    ipst);
1820 		}
1821 		if (tcp->tcp_conn_req_max && lconnp == NULL) {
1822 			tcp->tcp_state = TCPS_LISTEN;
1823 			DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1824 			    connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1825 			    NULL, int32_t, old_state);
1826 		} else if (old_state > TCPS_BOUND) {
1827 			tcp->tcp_conn_req_max = 0;
1828 			tcp->tcp_state = TCPS_BOUND;
1829 			DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1830 			    connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1831 			    NULL, int32_t, old_state);
1832 
1833 			/*
1834 			 * If this end point is not going to become a listener,
1835 			 * decrement the listener connection count if
1836 			 * necessary.  Note that we do not do this if it is
1837 			 * going to be a listner (the above if case) since
1838 			 * then it may remove the counter struct.
1839 			 */
1840 			if (tcp->tcp_listen_cnt != NULL)
1841 				TCP_DECR_LISTEN_CNT(tcp);
1842 		}
1843 		if (lconnp != NULL)
1844 			CONN_DEC_REF(lconnp);
1845 		switch (old_state) {
1846 		case TCPS_SYN_SENT:
1847 		case TCPS_SYN_RCVD:
1848 			TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1849 			break;
1850 		case TCPS_ESTABLISHED:
1851 		case TCPS_CLOSE_WAIT:
1852 			TCPS_BUMP_MIB(tcps, tcpEstabResets);
1853 			break;
1854 		}
1855 
1856 		if (tcp->tcp_fused)
1857 			tcp_unfuse(tcp);
1858 
1859 		mutex_enter(&tcp->tcp_eager_lock);
1860 		if ((tcp->tcp_conn_req_cnt_q0 != 0) ||
1861 		    (tcp->tcp_conn_req_cnt_q != 0)) {
1862 			tcp_eager_cleanup(tcp, 0);
1863 		}
1864 		mutex_exit(&tcp->tcp_eager_lock);
1865 
1866 		tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt,
1867 		    tcp->tcp_rnxt, TH_RST | TH_ACK);
1868 
1869 		tcp_reinit(tcp);
1870 
1871 		return (0);
1872 	} else if (!tcp_eager_blowoff(tcp, seqnum)) {
1873 		return (TBADSEQ);
1874 	}
1875 	return (0);
1876 }
1877 
1878 /*
1879  * Our client hereby directs us to reject the connection request
1880  * that tcp_input_listener() marked with 'seqnum'.  Rejection consists
1881  * of sending the appropriate RST, not an ICMP error.
1882  */
1883 void
tcp_disconnect(tcp_t * tcp,mblk_t * mp)1884 tcp_disconnect(tcp_t *tcp, mblk_t *mp)
1885 {
1886 	t_scalar_t seqnum;
1887 	int	error;
1888 	conn_t	*connp = tcp->tcp_connp;
1889 
1890 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
1891 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) {
1892 		tcp_err_ack(tcp, mp, TPROTO, 0);
1893 		return;
1894 	}
1895 	seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number;
1896 	error = tcp_disconnect_common(tcp, seqnum);
1897 	if (error != 0)
1898 		tcp_err_ack(tcp, mp, error, 0);
1899 	else {
1900 		if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1901 			/* Send M_FLUSH according to TPI */
1902 			(void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW);
1903 		}
1904 		mp = mi_tpi_ok_ack_alloc(mp);
1905 		if (mp != NULL)
1906 			putnext(connp->conn_rq, mp);
1907 	}
1908 }
1909 
1910 /*
1911  * Handle reinitialization of a tcp structure.
1912  * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE.
1913  */
1914 static void
tcp_reinit(tcp_t * tcp)1915 tcp_reinit(tcp_t *tcp)
1916 {
1917 	mblk_t		*mp;
1918 	tcp_stack_t	*tcps = tcp->tcp_tcps;
1919 	conn_t		*connp  = tcp->tcp_connp;
1920 	int32_t		oldstate;
1921 
1922 	/* tcp_reinit should never be called for detached tcp_t's */
1923 	ASSERT(tcp->tcp_listener == NULL);
1924 	ASSERT((connp->conn_family == AF_INET &&
1925 	    connp->conn_ipversion == IPV4_VERSION) ||
1926 	    (connp->conn_family == AF_INET6 &&
1927 	    (connp->conn_ipversion == IPV4_VERSION ||
1928 	    connp->conn_ipversion == IPV6_VERSION)));
1929 
1930 	/* Cancel outstanding timers */
1931 	tcp_timers_stop(tcp);
1932 
1933 	tcp_close_mpp(&tcp->tcp_xmit_head);
1934 	if (tcp->tcp_snd_zcopy_aware)
1935 		tcp_zcopy_notify(tcp);
1936 	tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL;
1937 	tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0;
1938 	mutex_enter(&tcp->tcp_non_sq_lock);
1939 	if (tcp->tcp_flow_stopped &&
1940 	    TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) {
1941 		tcp_clrqfull(tcp);
1942 	}
1943 	mutex_exit(&tcp->tcp_non_sq_lock);
1944 	tcp_close_mpp(&tcp->tcp_reass_head);
1945 	tcp->tcp_reass_tail = NULL;
1946 	if (tcp->tcp_rcv_list != NULL) {
1947 		/* Free b_next chain */
1948 		tcp_close_mpp(&tcp->tcp_rcv_list);
1949 		tcp->tcp_rcv_last_head = NULL;
1950 		tcp->tcp_rcv_last_tail = NULL;
1951 		tcp->tcp_rcv_cnt = 0;
1952 	}
1953 	tcp->tcp_rcv_last_tail = NULL;
1954 
1955 	if ((mp = tcp->tcp_urp_mp) != NULL) {
1956 		freemsg(mp);
1957 		tcp->tcp_urp_mp = NULL;
1958 	}
1959 	if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1960 		freemsg(mp);
1961 		tcp->tcp_urp_mark_mp = NULL;
1962 	}
1963 	if (tcp->tcp_fused_sigurg_mp != NULL) {
1964 		ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1965 		freeb(tcp->tcp_fused_sigurg_mp);
1966 		tcp->tcp_fused_sigurg_mp = NULL;
1967 	}
1968 	if (tcp->tcp_ordrel_mp != NULL) {
1969 		ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1970 		freeb(tcp->tcp_ordrel_mp);
1971 		tcp->tcp_ordrel_mp = NULL;
1972 	}
1973 
1974 	/*
1975 	 * Following is a union with two members which are
1976 	 * identical types and size so the following cleanup
1977 	 * is enough.
1978 	 */
1979 	tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1980 
1981 	CL_INET_DISCONNECT(connp);
1982 
1983 	/*
1984 	 * The connection can't be on the tcp_time_wait_head list
1985 	 * since it is not detached.
1986 	 */
1987 	ASSERT(tcp->tcp_time_wait_next == NULL);
1988 	ASSERT(tcp->tcp_time_wait_prev == NULL);
1989 	ASSERT(tcp->tcp_time_wait_expire == 0);
1990 
1991 	/*
1992 	 * Reset/preserve other values
1993 	 */
1994 	tcp_reinit_values(tcp);
1995 	ipcl_hash_remove(connp);
1996 	/* Note that ixa_cred gets cleared in ixa_cleanup */
1997 	ixa_cleanup(connp->conn_ixa);
1998 	tcp_ipsec_cleanup(tcp);
1999 
2000 	connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
2001 	connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2002 	oldstate = tcp->tcp_state;
2003 
2004 	if (tcp->tcp_conn_req_max != 0) {
2005 		/*
2006 		 * This is the case when a TLI program uses the same
2007 		 * transport end point to accept a connection.  This
2008 		 * makes the TCP both a listener and acceptor.  When
2009 		 * this connection is closed, we need to set the state
2010 		 * back to TCPS_LISTEN.  Make sure that the eager list
2011 		 * is reinitialized.
2012 		 *
2013 		 * Note that this stream is still bound to the four
2014 		 * tuples of the previous connection in IP.  If a new
2015 		 * SYN with different foreign address comes in, IP will
2016 		 * not find it and will send it to the global queue.  In
2017 		 * the global queue, TCP will do a tcp_lookup_listener()
2018 		 * to find this stream.  This works because this stream
2019 		 * is only removed from connected hash.
2020 		 *
2021 		 */
2022 		tcp->tcp_state = TCPS_LISTEN;
2023 		tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
2024 		tcp->tcp_eager_next_drop_q0 = tcp;
2025 		tcp->tcp_eager_prev_drop_q0 = tcp;
2026 		/*
2027 		 * Initially set conn_recv to tcp_input_listener_unbound to try
2028 		 * to pick a good squeue for the listener when the first SYN
2029 		 * arrives. tcp_input_listener_unbound sets it to
2030 		 * tcp_input_listener on that first SYN.
2031 		 */
2032 		connp->conn_recv = tcp_input_listener_unbound;
2033 
2034 		connp->conn_proto = IPPROTO_TCP;
2035 		connp->conn_faddr_v6 = ipv6_all_zeros;
2036 		connp->conn_fport = 0;
2037 
2038 		(void) ipcl_bind_insert(connp);
2039 	} else {
2040 		tcp->tcp_state = TCPS_BOUND;
2041 	}
2042 
2043 	/*
2044 	 * Initialize to default values
2045 	 */
2046 	tcp_init_values(tcp, NULL);
2047 
2048 	DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2049 	    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
2050 	    int32_t, oldstate);
2051 
2052 	ASSERT(tcp->tcp_ptpbhn != NULL);
2053 	tcp->tcp_rwnd = connp->conn_rcvbuf;
2054 	tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ?
2055 	    tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4;
2056 }
2057 
2058 /*
2059  * Force values to zero that need be zero.
2060  * Do not touch values asociated with the BOUND or LISTEN state
2061  * since the connection will end up in that state after the reinit.
2062  * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t
2063  * structure!
2064  */
2065 static void
tcp_reinit_values(tcp_t * tcp)2066 tcp_reinit_values(tcp_t *tcp)
2067 {
2068 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2069 	conn_t		*connp = tcp->tcp_connp;
2070 
2071 #ifndef	lint
2072 #define	DONTCARE(x)
2073 #define	PRESERVE(x)
2074 #else
2075 #define	DONTCARE(x)	((x) = (x))
2076 #define	PRESERVE(x)	((x) = (x))
2077 #endif	/* lint */
2078 
2079 	PRESERVE(tcp->tcp_bind_hash_port);
2080 	PRESERVE(tcp->tcp_bind_hash);
2081 	PRESERVE(tcp->tcp_ptpbhn);
2082 	PRESERVE(tcp->tcp_acceptor_hash);
2083 	PRESERVE(tcp->tcp_ptpahn);
2084 
2085 	/* Should be ASSERT NULL on these with new code! */
2086 	ASSERT(tcp->tcp_time_wait_next == NULL);
2087 	ASSERT(tcp->tcp_time_wait_prev == NULL);
2088 	ASSERT(tcp->tcp_time_wait_expire == 0);
2089 	PRESERVE(tcp->tcp_state);
2090 	PRESERVE(connp->conn_rq);
2091 	PRESERVE(connp->conn_wq);
2092 
2093 	ASSERT(tcp->tcp_xmit_head == NULL);
2094 	ASSERT(tcp->tcp_xmit_last == NULL);
2095 	ASSERT(tcp->tcp_unsent == 0);
2096 	ASSERT(tcp->tcp_xmit_tail == NULL);
2097 	ASSERT(tcp->tcp_xmit_tail_unsent == 0);
2098 
2099 	tcp->tcp_snxt = 0;			/* Displayed in mib */
2100 	tcp->tcp_suna = 0;			/* Displayed in mib */
2101 	tcp->tcp_swnd = 0;
2102 	DONTCARE(tcp->tcp_cwnd);	/* Init in tcp_process_options */
2103 
2104 	if (connp->conn_ht_iphc != NULL) {
2105 		kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
2106 		connp->conn_ht_iphc = NULL;
2107 		connp->conn_ht_iphc_allocated = 0;
2108 		connp->conn_ht_iphc_len = 0;
2109 		connp->conn_ht_ulp = NULL;
2110 		connp->conn_ht_ulp_len = 0;
2111 		tcp->tcp_ipha = NULL;
2112 		tcp->tcp_ip6h = NULL;
2113 		tcp->tcp_tcpha = NULL;
2114 	}
2115 
2116 	/* We clear any IP_OPTIONS and extension headers */
2117 	ip_pkt_free(&connp->conn_xmit_ipp);
2118 
2119 	DONTCARE(tcp->tcp_naglim);		/* Init in tcp_init_values */
2120 	DONTCARE(tcp->tcp_ipha);
2121 	DONTCARE(tcp->tcp_ip6h);
2122 	DONTCARE(tcp->tcp_tcpha);
2123 	tcp->tcp_valid_bits = 0;
2124 
2125 	DONTCARE(tcp->tcp_timer_backoff);	/* Init in tcp_init_values */
2126 	DONTCARE(tcp->tcp_last_recv_time);	/* Init in tcp_init_values */
2127 	tcp->tcp_last_rcv_lbolt = 0;
2128 
2129 	tcp->tcp_init_cwnd = 0;
2130 
2131 	tcp->tcp_urp_last_valid = 0;
2132 	tcp->tcp_hard_binding = 0;
2133 
2134 	tcp->tcp_fin_acked = 0;
2135 	tcp->tcp_fin_rcvd = 0;
2136 	tcp->tcp_fin_sent = 0;
2137 	tcp->tcp_ordrel_done = 0;
2138 
2139 	tcp->tcp_detached = 0;
2140 
2141 	tcp->tcp_snd_ws_ok = B_FALSE;
2142 	tcp->tcp_snd_ts_ok = B_FALSE;
2143 	tcp->tcp_zero_win_probe = 0;
2144 
2145 	tcp->tcp_loopback = 0;
2146 	tcp->tcp_localnet = 0;
2147 	tcp->tcp_syn_defense = 0;
2148 	tcp->tcp_set_timer = 0;
2149 
2150 	tcp->tcp_active_open = 0;
2151 	tcp->tcp_rexmit = B_FALSE;
2152 	tcp->tcp_xmit_zc_clean = B_FALSE;
2153 
2154 	tcp->tcp_snd_sack_ok = B_FALSE;
2155 	tcp->tcp_hwcksum = B_FALSE;
2156 
2157 	DONTCARE(tcp->tcp_maxpsz_multiplier);	/* Init in tcp_init_values */
2158 
2159 	tcp->tcp_conn_def_q0 = 0;
2160 	tcp->tcp_ip_forward_progress = B_FALSE;
2161 	tcp->tcp_ecn_ok = B_FALSE;
2162 
2163 	tcp->tcp_cwr = B_FALSE;
2164 	tcp->tcp_ecn_echo_on = B_FALSE;
2165 	tcp->tcp_is_wnd_shrnk = B_FALSE;
2166 
2167 	TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
2168 	bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
2169 
2170 	tcp->tcp_rcv_ws = 0;
2171 	tcp->tcp_snd_ws = 0;
2172 	tcp->tcp_ts_recent = 0;
2173 	tcp->tcp_rnxt = 0;			/* Displayed in mib */
2174 	DONTCARE(tcp->tcp_rwnd);		/* Set in tcp_reinit() */
2175 	tcp->tcp_initial_pmtu = 0;
2176 
2177 	ASSERT(tcp->tcp_reass_head == NULL);
2178 	ASSERT(tcp->tcp_reass_tail == NULL);
2179 
2180 	tcp->tcp_cwnd_cnt = 0;
2181 
2182 	ASSERT(tcp->tcp_rcv_list == NULL);
2183 	ASSERT(tcp->tcp_rcv_last_head == NULL);
2184 	ASSERT(tcp->tcp_rcv_last_tail == NULL);
2185 	ASSERT(tcp->tcp_rcv_cnt == 0);
2186 
2187 	DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */
2188 	DONTCARE(tcp->tcp_cwnd_max);		/* Init in tcp_init_values */
2189 	tcp->tcp_csuna = 0;
2190 
2191 	tcp->tcp_rto = 0;			/* Displayed in MIB */
2192 	DONTCARE(tcp->tcp_rtt_sa);		/* Init in tcp_init_values */
2193 	DONTCARE(tcp->tcp_rtt_sd);		/* Init in tcp_init_values */
2194 	tcp->tcp_rtt_update = 0;
2195 	tcp->tcp_rtt_sum = 0;
2196 	tcp->tcp_rtt_cnt = 0;
2197 
2198 	DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2199 	DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2200 
2201 	tcp->tcp_rack = 0;			/* Displayed in mib */
2202 	tcp->tcp_rack_cnt = 0;
2203 	tcp->tcp_rack_cur_max = 0;
2204 	tcp->tcp_rack_abs_max = 0;
2205 
2206 	tcp->tcp_max_swnd = 0;
2207 
2208 	ASSERT(tcp->tcp_listener == NULL);
2209 
2210 	DONTCARE(tcp->tcp_irs);			/* tcp_valid_bits cleared */
2211 	DONTCARE(tcp->tcp_iss);			/* tcp_valid_bits cleared */
2212 	DONTCARE(tcp->tcp_fss);			/* tcp_valid_bits cleared */
2213 	DONTCARE(tcp->tcp_urg);			/* tcp_valid_bits cleared */
2214 
2215 	ASSERT(tcp->tcp_conn_req_cnt_q == 0);
2216 	ASSERT(tcp->tcp_conn_req_cnt_q0 == 0);
2217 	PRESERVE(tcp->tcp_conn_req_max);
2218 	PRESERVE(tcp->tcp_conn_req_seqnum);
2219 
2220 	DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */
2221 	DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */
2222 	DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */
2223 	DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */
2224 
2225 	DONTCARE(tcp->tcp_urp_last);	/* tcp_urp_last_valid is cleared */
2226 	ASSERT(tcp->tcp_urp_mp == NULL);
2227 	ASSERT(tcp->tcp_urp_mark_mp == NULL);
2228 	ASSERT(tcp->tcp_fused_sigurg_mp == NULL);
2229 
2230 	ASSERT(tcp->tcp_eager_next_q == NULL);
2231 	ASSERT(tcp->tcp_eager_last_q == NULL);
2232 	ASSERT((tcp->tcp_eager_next_q0 == NULL &&
2233 	    tcp->tcp_eager_prev_q0 == NULL) ||
2234 	    tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0);
2235 	ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
2236 
2237 	ASSERT((tcp->tcp_eager_next_drop_q0 == NULL &&
2238 	    tcp->tcp_eager_prev_drop_q0 == NULL) ||
2239 	    tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0);
2240 
2241 	DONTCARE(tcp->tcp_ka_rinterval);	/* Init in tcp_init_values */
2242 	DONTCARE(tcp->tcp_ka_abort_thres);	/* Init in tcp_init_values */
2243 	DONTCARE(tcp->tcp_ka_cnt);		/* Init in tcp_init_values */
2244 
2245 	tcp->tcp_client_errno = 0;
2246 
2247 	DONTCARE(connp->conn_sum);		/* Init in tcp_init_values */
2248 
2249 	connp->conn_faddr_v6 = ipv6_all_zeros;	/* Displayed in MIB */
2250 
2251 	PRESERVE(connp->conn_bound_addr_v6);
2252 	tcp->tcp_last_sent_len = 0;
2253 	tcp->tcp_dupack_cnt = 0;
2254 
2255 	connp->conn_fport = 0;			/* Displayed in MIB */
2256 	PRESERVE(connp->conn_lport);
2257 
2258 	PRESERVE(tcp->tcp_acceptor_lockp);
2259 
2260 	ASSERT(tcp->tcp_ordrel_mp == NULL);
2261 	PRESERVE(tcp->tcp_acceptor_id);
2262 	DONTCARE(tcp->tcp_ipsec_overhead);
2263 
2264 	PRESERVE(connp->conn_family);
2265 	/* Remove any remnants of mapped address binding */
2266 	if (connp->conn_family == AF_INET6) {
2267 		connp->conn_ipversion = IPV6_VERSION;
2268 		tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2269 	} else {
2270 		connp->conn_ipversion = IPV4_VERSION;
2271 		tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2272 	}
2273 
2274 	connp->conn_bound_if = 0;
2275 	connp->conn_recv_ancillary.crb_all = 0;
2276 	tcp->tcp_recvifindex = 0;
2277 	tcp->tcp_recvhops = 0;
2278 	tcp->tcp_closed = 0;
2279 	if (tcp->tcp_hopopts != NULL) {
2280 		mi_free(tcp->tcp_hopopts);
2281 		tcp->tcp_hopopts = NULL;
2282 		tcp->tcp_hopoptslen = 0;
2283 	}
2284 	ASSERT(tcp->tcp_hopoptslen == 0);
2285 	if (tcp->tcp_dstopts != NULL) {
2286 		mi_free(tcp->tcp_dstopts);
2287 		tcp->tcp_dstopts = NULL;
2288 		tcp->tcp_dstoptslen = 0;
2289 	}
2290 	ASSERT(tcp->tcp_dstoptslen == 0);
2291 	if (tcp->tcp_rthdrdstopts != NULL) {
2292 		mi_free(tcp->tcp_rthdrdstopts);
2293 		tcp->tcp_rthdrdstopts = NULL;
2294 		tcp->tcp_rthdrdstoptslen = 0;
2295 	}
2296 	ASSERT(tcp->tcp_rthdrdstoptslen == 0);
2297 	if (tcp->tcp_rthdr != NULL) {
2298 		mi_free(tcp->tcp_rthdr);
2299 		tcp->tcp_rthdr = NULL;
2300 		tcp->tcp_rthdrlen = 0;
2301 	}
2302 	ASSERT(tcp->tcp_rthdrlen == 0);
2303 
2304 	/* Reset fusion-related fields */
2305 	tcp->tcp_fused = B_FALSE;
2306 	tcp->tcp_unfusable = B_FALSE;
2307 	tcp->tcp_fused_sigurg = B_FALSE;
2308 	tcp->tcp_loopback_peer = NULL;
2309 
2310 	tcp->tcp_lso = B_FALSE;
2311 
2312 	tcp->tcp_in_ack_unsent = 0;
2313 	tcp->tcp_cork = B_FALSE;
2314 	tcp->tcp_tconnind_started = B_FALSE;
2315 
2316 	PRESERVE(tcp->tcp_squeue_bytes);
2317 
2318 	tcp->tcp_closemp_used = B_FALSE;
2319 
2320 	PRESERVE(tcp->tcp_rsrv_mp);
2321 	PRESERVE(tcp->tcp_rsrv_mp_lock);
2322 
2323 #ifdef DEBUG
2324 	DONTCARE(tcp->tcmp_stk[0]);
2325 #endif
2326 
2327 	PRESERVE(tcp->tcp_connid);
2328 
2329 	ASSERT(tcp->tcp_listen_cnt == NULL);
2330 	ASSERT(tcp->tcp_reass_tid == 0);
2331 
2332 	/* Allow the CC algorithm to clean up after itself. */
2333 	if (tcp->tcp_cc_algo->cb_destroy != NULL)
2334 		tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv);
2335 	tcp->tcp_cc_algo = NULL;
2336 
2337 #undef	DONTCARE
2338 #undef	PRESERVE
2339 }
2340 
2341 /*
2342  * Initialize the various fields in tcp_t.  If parent (the listener) is non
2343  * NULL, certain values will be inheritted from it.
2344  */
2345 void
tcp_init_values(tcp_t * tcp,tcp_t * parent)2346 tcp_init_values(tcp_t *tcp, tcp_t *parent)
2347 {
2348 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2349 	conn_t		*connp = tcp->tcp_connp;
2350 
2351 	ASSERT((connp->conn_family == AF_INET &&
2352 	    connp->conn_ipversion == IPV4_VERSION) ||
2353 	    (connp->conn_family == AF_INET6 &&
2354 	    (connp->conn_ipversion == IPV4_VERSION ||
2355 	    connp->conn_ipversion == IPV6_VERSION)));
2356 
2357 	tcp->tcp_ccv.type = IPPROTO_TCP;
2358 	tcp->tcp_ccv.ccvc.tcp = tcp;
2359 
2360 	if (parent == NULL) {
2361 		tcp->tcp_cc_algo = tcps->tcps_default_cc_algo;
2362 
2363 		tcp->tcp_naglim = tcps->tcps_naglim_def;
2364 
2365 		tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial;
2366 		tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min;
2367 		tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max;
2368 
2369 		tcp->tcp_first_ctimer_threshold =
2370 		    tcps->tcps_ip_notify_cinterval;
2371 		tcp->tcp_second_ctimer_threshold =
2372 		    tcps->tcps_ip_abort_cinterval;
2373 		tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval;
2374 		tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval;
2375 
2376 		tcp->tcp_fin_wait_2_flush_interval =
2377 		    tcps->tcps_fin_wait_2_flush_interval;
2378 
2379 		tcp->tcp_ka_interval = tcps->tcps_keepalive_interval;
2380 		tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval;
2381 		tcp->tcp_ka_cnt = 0;
2382 		tcp->tcp_ka_rinterval = 0;
2383 
2384 		/*
2385 		 * Default value of tcp_init_cwnd is 0, so no need to set here
2386 		 * if parent is NULL.  But we need to inherit it from parent.
2387 		 */
2388 	} else {
2389 		/* Inherit various TCP parameters from the parent. */
2390 		tcp->tcp_cc_algo = parent->tcp_cc_algo;
2391 
2392 		tcp->tcp_naglim = parent->tcp_naglim;
2393 
2394 		tcp->tcp_rto_initial = parent->tcp_rto_initial;
2395 		tcp->tcp_rto_min = parent->tcp_rto_min;
2396 		tcp->tcp_rto_max = parent->tcp_rto_max;
2397 
2398 		tcp->tcp_first_ctimer_threshold =
2399 		    parent->tcp_first_ctimer_threshold;
2400 		tcp->tcp_second_ctimer_threshold =
2401 		    parent->tcp_second_ctimer_threshold;
2402 		tcp->tcp_first_timer_threshold =
2403 		    parent->tcp_first_timer_threshold;
2404 		tcp->tcp_second_timer_threshold =
2405 		    parent->tcp_second_timer_threshold;
2406 
2407 		tcp->tcp_fin_wait_2_flush_interval =
2408 		    parent->tcp_fin_wait_2_flush_interval;
2409 
2410 		tcp->tcp_ka_interval = parent->tcp_ka_interval;
2411 		tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres;
2412 		tcp->tcp_ka_cnt = parent->tcp_ka_cnt;
2413 		tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval;
2414 
2415 		tcp->tcp_init_cwnd = parent->tcp_init_cwnd;
2416 	}
2417 
2418 	if (tcp->tcp_cc_algo->cb_init != NULL)
2419 		VERIFY(tcp->tcp_cc_algo->cb_init(&tcp->tcp_ccv) == 0);
2420 
2421 	/*
2422 	 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
2423 	 * will be close to tcp_rexmit_interval_initial.  By doing this, we
2424 	 * allow the algorithm to adjust slowly to large fluctuations of RTT
2425 	 * during first few transmissions of a connection as seen in slow
2426 	 * links.
2427 	 */
2428 	tcp->tcp_rtt_sa = MSEC2NSEC(tcp->tcp_rto_initial) << 2;
2429 	tcp->tcp_rtt_sd = MSEC2NSEC(tcp->tcp_rto_initial) >> 1;
2430 	tcp->tcp_rto = tcp_calculate_rto(tcp, tcps,
2431 	    tcps->tcps_conn_grace_period);
2432 
2433 	tcp->tcp_timer_backoff = 0;
2434 	tcp->tcp_ms_we_have_waited = 0;
2435 	tcp->tcp_last_recv_time = ddi_get_lbolt();
2436 	tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_;
2437 	tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
2438 
2439 	tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier;
2440 
2441 	/* NOTE:  ISS is now set in tcp_set_destination(). */
2442 
2443 	/* Reset fusion-related fields */
2444 	tcp->tcp_fused = B_FALSE;
2445 	tcp->tcp_unfusable = B_FALSE;
2446 	tcp->tcp_fused_sigurg = B_FALSE;
2447 	tcp->tcp_loopback_peer = NULL;
2448 
2449 	/* We rebuild the header template on the next connect/conn_request */
2450 
2451 	connp->conn_mlp_type = mlptSingle;
2452 
2453 	/*
2454 	 * Init the window scale to the max so tcp_rwnd_set() won't pare
2455 	 * down tcp_rwnd. tcp_set_destination() will set the right value later.
2456 	 */
2457 	tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
2458 	tcp->tcp_rwnd = connp->conn_rcvbuf;
2459 
2460 	tcp->tcp_cork = B_FALSE;
2461 	/*
2462 	 * Init the tcp_debug option if it wasn't already set.  This value
2463 	 * determines whether TCP
2464 	 * calls strlog() to print out debug messages.  Doing this
2465 	 * initialization here means that this value is not inherited thru
2466 	 * tcp_reinit().
2467 	 */
2468 	if (!connp->conn_debug)
2469 		connp->conn_debug = tcps->tcps_dbg;
2470 }
2471 
2472 /*
2473  * Update the TCP connection according to change of PMTU.
2474  *
2475  * Path MTU might have changed by either increase or decrease, so need to
2476  * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny
2477  * or negative MSS, since tcp_mss_set() will do it.
2478  */
2479 void
tcp_update_pmtu(tcp_t * tcp,boolean_t decrease_only)2480 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
2481 {
2482 	uint32_t	pmtu;
2483 	int32_t		mss;
2484 	conn_t		*connp = tcp->tcp_connp;
2485 	ip_xmit_attr_t	*ixa = connp->conn_ixa;
2486 	iaflags_t	ixaflags;
2487 
2488 	if (tcp->tcp_tcps->tcps_ignore_path_mtu)
2489 		return;
2490 
2491 	if (tcp->tcp_state < TCPS_ESTABLISHED)
2492 		return;
2493 
2494 	/*
2495 	 * Always call ip_get_pmtu() to make sure that IP has updated
2496 	 * ixa_flags properly.
2497 	 */
2498 	pmtu = ip_get_pmtu(ixa);
2499 	ixaflags = ixa->ixa_flags;
2500 
2501 	/*
2502 	 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and
2503 	 * IPsec overhead if applied. Make sure to use the most recent
2504 	 * IPsec information.
2505 	 */
2506 	mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp);
2507 
2508 	/*
2509 	 * Nothing to change, so just return.
2510 	 */
2511 	if (mss == tcp->tcp_mss)
2512 		return;
2513 
2514 	/*
2515 	 * Currently, for ICMP errors, only PMTU decrease is handled.
2516 	 */
2517 	if (mss > tcp->tcp_mss && decrease_only)
2518 		return;
2519 
2520 	DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss);
2521 
2522 	/*
2523 	 * Update ixa_fragsize and ixa_pmtu.
2524 	 */
2525 	ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu;
2526 
2527 	/*
2528 	 * Adjust MSS and all relevant variables.
2529 	 */
2530 	tcp_mss_set(tcp, mss);
2531 
2532 	/*
2533 	 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu
2534 	 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP
2535 	 * has a (potentially different) min size we do the same. Make sure to
2536 	 * clear IXAF_DONTFRAG, which is used by IP to decide whether to
2537 	 * fragment the packet.
2538 	 *
2539 	 * LSO over IPv6 can not be fragmented. So need to disable LSO
2540 	 * when IPv6 fragmentation is needed.
2541 	 */
2542 	if (mss < tcp->tcp_tcps->tcps_mss_min)
2543 		ixaflags |= IXAF_PMTU_TOO_SMALL;
2544 
2545 	if (ixaflags & IXAF_PMTU_TOO_SMALL)
2546 		ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
2547 
2548 	if ((connp->conn_ipversion == IPV4_VERSION) &&
2549 	    !(ixaflags & IXAF_PMTU_IPV4_DF)) {
2550 		tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
2551 	}
2552 	ixa->ixa_flags = ixaflags;
2553 }
2554 
2555 int
tcp_maxpsz_set(tcp_t * tcp,boolean_t set_maxblk)2556 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk)
2557 {
2558 	conn_t	*connp = tcp->tcp_connp;
2559 	queue_t	*q = connp->conn_rq;
2560 	int32_t	mss = tcp->tcp_mss;
2561 	int	maxpsz;
2562 
2563 	if (TCP_IS_DETACHED(tcp))
2564 		return (mss);
2565 	if (tcp->tcp_fused) {
2566 		maxpsz = tcp_fuse_maxpsz(tcp);
2567 		mss = INFPSZ;
2568 	} else if (tcp->tcp_maxpsz_multiplier == 0) {
2569 		/*
2570 		 * Set the sd_qn_maxpsz according to the socket send buffer
2571 		 * size, and sd_maxblk to INFPSZ (-1).  This will essentially
2572 		 * instruct the stream head to copyin user data into contiguous
2573 		 * kernel-allocated buffers without breaking it up into smaller
2574 		 * chunks.  We round up the buffer size to the nearest SMSS.
2575 		 */
2576 		maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss);
2577 		mss = INFPSZ;
2578 	} else {
2579 		/*
2580 		 * Set sd_qn_maxpsz to approx half the (receivers) buffer
2581 		 * (and a multiple of the mss).  This instructs the stream
2582 		 * head to break down larger than SMSS writes into SMSS-
2583 		 * size mblks, up to tcp_maxpsz_multiplier mblks at a time.
2584 		 */
2585 		maxpsz = tcp->tcp_maxpsz_multiplier * mss;
2586 		if (maxpsz > connp->conn_sndbuf / 2) {
2587 			maxpsz = connp->conn_sndbuf / 2;
2588 			/* Round up to nearest mss */
2589 			maxpsz = MSS_ROUNDUP(maxpsz, mss);
2590 		}
2591 	}
2592 
2593 	(void) proto_set_maxpsz(q, connp, maxpsz);
2594 	if (!(IPCL_IS_NONSTR(connp)))
2595 		connp->conn_wq->q_maxpsz = maxpsz;
2596 	if (set_maxblk)
2597 		(void) proto_set_tx_maxblk(q, connp, mss);
2598 	return (mss);
2599 }
2600 
2601 /* For /dev/tcp aka AF_INET open */
2602 static int
tcp_openv4(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp)2603 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2604 {
2605 	return (tcp_open(q, devp, flag, sflag, credp, B_FALSE));
2606 }
2607 
2608 /* For /dev/tcp6 aka AF_INET6 open */
2609 static int
tcp_openv6(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp)2610 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2611 {
2612 	return (tcp_open(q, devp, flag, sflag, credp, B_TRUE));
2613 }
2614 
2615 conn_t *
tcp_create_common(cred_t * credp,boolean_t isv6,boolean_t issocket,int * errorp)2616 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket,
2617     int *errorp)
2618 {
2619 	tcp_t		*tcp = NULL;
2620 	conn_t		*connp;
2621 	zoneid_t	zoneid;
2622 	tcp_stack_t	*tcps;
2623 	squeue_t	*sqp;
2624 
2625 	ASSERT(errorp != NULL);
2626 	/*
2627 	 * Find the proper zoneid and netstack.
2628 	 */
2629 	/*
2630 	 * Special case for install: miniroot needs to be able to
2631 	 * access files via NFS as though it were always in the
2632 	 * global zone.
2633 	 */
2634 	if (credp == kcred && nfs_global_client_only != 0) {
2635 		zoneid = GLOBAL_ZONEID;
2636 		tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)->
2637 		    netstack_tcp;
2638 		ASSERT(tcps != NULL);
2639 	} else {
2640 		netstack_t *ns;
2641 		int err;
2642 
2643 		if ((err = secpolicy_basic_net_access(credp)) != 0) {
2644 			*errorp = err;
2645 			return (NULL);
2646 		}
2647 
2648 		ns = netstack_find_by_cred(credp);
2649 		ASSERT(ns != NULL);
2650 		tcps = ns->netstack_tcp;
2651 		ASSERT(tcps != NULL);
2652 
2653 		/*
2654 		 * For exclusive stacks we set the zoneid to zero
2655 		 * to make TCP operate as if in the global zone.
2656 		 */
2657 		if (tcps->tcps_netstack->netstack_stackid !=
2658 		    GLOBAL_NETSTACKID)
2659 			zoneid = GLOBAL_ZONEID;
2660 		else
2661 			zoneid = crgetzoneid(credp);
2662 	}
2663 
2664 	sqp = IP_SQUEUE_GET((uint_t)gethrtime());
2665 	connp = tcp_get_conn(sqp, tcps);
2666 	/*
2667 	 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt,
2668 	 * so we drop it by one.
2669 	 */
2670 	netstack_rele(tcps->tcps_netstack);
2671 	if (connp == NULL) {
2672 		*errorp = ENOSR;
2673 		return (NULL);
2674 	}
2675 	ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
2676 
2677 	connp->conn_sqp = sqp;
2678 	connp->conn_initial_sqp = connp->conn_sqp;
2679 	connp->conn_ixa->ixa_sqp = connp->conn_sqp;
2680 	tcp = connp->conn_tcp;
2681 
2682 	/*
2683 	 * Besides asking IP to set the checksum for us, have conn_ip_output
2684 	 * to do the following checks when necessary:
2685 	 *
2686 	 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid
2687 	 * IXAF_VERIFY_PMTU: verify PMTU changes
2688 	 * IXAF_VERIFY_LSO: verify LSO capability changes
2689 	 */
2690 	connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
2691 	    IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO;
2692 
2693 	if (!tcps->tcps_dev_flow_ctl)
2694 		connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
2695 
2696 	if (isv6) {
2697 		connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
2698 		connp->conn_ipversion = IPV6_VERSION;
2699 		connp->conn_family = AF_INET6;
2700 		tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2701 		connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit;
2702 	} else {
2703 		connp->conn_ipversion = IPV4_VERSION;
2704 		connp->conn_family = AF_INET;
2705 		tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2706 		connp->conn_default_ttl = tcps->tcps_ipv4_ttl;
2707 	}
2708 	connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
2709 
2710 	crhold(credp);
2711 	connp->conn_cred = credp;
2712 	connp->conn_cpid = curproc->p_pid;
2713 	connp->conn_open_time = ddi_get_lbolt64();
2714 
2715 	/* Cache things in the ixa without any refhold */
2716 	ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
2717 	connp->conn_ixa->ixa_cred = credp;
2718 	connp->conn_ixa->ixa_cpid = connp->conn_cpid;
2719 
2720 	connp->conn_zoneid = zoneid;
2721 	/* conn_allzones can not be set this early, hence no IPCL_ZONEID */
2722 	connp->conn_ixa->ixa_zoneid = zoneid;
2723 	connp->conn_mlp_type = mlptSingle;
2724 	ASSERT(connp->conn_netstack == tcps->tcps_netstack);
2725 	ASSERT(tcp->tcp_tcps == tcps);
2726 
2727 	/*
2728 	 * If the caller has the process-wide flag set, then default to MAC
2729 	 * exempt mode.  This allows read-down to unlabeled hosts.
2730 	 */
2731 	if (getpflags(NET_MAC_AWARE, credp) != 0)
2732 		connp->conn_mac_mode = CONN_MAC_AWARE;
2733 
2734 	connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
2735 
2736 	if (issocket) {
2737 		tcp->tcp_issocket = 1;
2738 	}
2739 
2740 	connp->conn_rcvbuf = tcps->tcps_recv_hiwat;
2741 	connp->conn_sndbuf = tcps->tcps_xmit_hiwat;
2742 	if (tcps->tcps_snd_lowat_fraction != 0) {
2743 		connp->conn_sndlowat = connp->conn_sndbuf /
2744 		    tcps->tcps_snd_lowat_fraction;
2745 	} else {
2746 		connp->conn_sndlowat = tcps->tcps_xmit_lowat;
2747 	}
2748 	connp->conn_so_type = SOCK_STREAM;
2749 	connp->conn_wroff = connp->conn_ht_iphc_allocated +
2750 	    tcps->tcps_wroff_xtra;
2751 
2752 	SOCK_CONNID_INIT(tcp->tcp_connid);
2753 	/* DTrace ignores this - it isn't a tcp:::state-change */
2754 	tcp->tcp_state = TCPS_IDLE;
2755 	tcp_init_values(tcp, NULL);
2756 	return (connp);
2757 }
2758 
2759 static int
tcp_open(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp,boolean_t isv6)2760 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
2761     boolean_t isv6)
2762 {
2763 	tcp_t		*tcp = NULL;
2764 	conn_t		*connp = NULL;
2765 	int		err;
2766 	vmem_t		*minor_arena = NULL;
2767 	dev_t		conn_dev;
2768 	boolean_t	issocket;
2769 
2770 	if (q->q_ptr != NULL)
2771 		return (0);
2772 
2773 	if (sflag == MODOPEN)
2774 		return (EINVAL);
2775 
2776 	if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
2777 	    ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
2778 		minor_arena = ip_minor_arena_la;
2779 	} else {
2780 		/*
2781 		 * Either minor numbers in the large arena were exhausted
2782 		 * or a non socket application is doing the open.
2783 		 * Try to allocate from the small arena.
2784 		 */
2785 		if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
2786 			return (EBUSY);
2787 		}
2788 		minor_arena = ip_minor_arena_sa;
2789 	}
2790 
2791 	ASSERT(minor_arena != NULL);
2792 
2793 	*devp = makedevice(getmajor(*devp), (minor_t)conn_dev);
2794 
2795 	if (flag & SO_FALLBACK) {
2796 		/*
2797 		 * Non streams socket needs a stream to fallback to
2798 		 */
2799 		RD(q)->q_ptr = (void *)conn_dev;
2800 		WR(q)->q_qinfo = &tcp_fallback_sock_winit;
2801 		WR(q)->q_ptr = (void *)minor_arena;
2802 		qprocson(q);
2803 		return (0);
2804 	} else if (flag & SO_ACCEPTOR) {
2805 		q->q_qinfo = &tcp_acceptor_rinit;
2806 		/*
2807 		 * the conn_dev and minor_arena will be subsequently used by
2808 		 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out
2809 		 * the minor device number for this connection from the q_ptr.
2810 		 */
2811 		RD(q)->q_ptr = (void *)conn_dev;
2812 		WR(q)->q_qinfo = &tcp_acceptor_winit;
2813 		WR(q)->q_ptr = (void *)minor_arena;
2814 		qprocson(q);
2815 		return (0);
2816 	}
2817 
2818 	issocket = flag & SO_SOCKSTR;
2819 	connp = tcp_create_common(credp, isv6, issocket, &err);
2820 
2821 	if (connp == NULL) {
2822 		inet_minor_free(minor_arena, conn_dev);
2823 		q->q_ptr = WR(q)->q_ptr = NULL;
2824 		return (err);
2825 	}
2826 
2827 	connp->conn_rq = q;
2828 	connp->conn_wq = WR(q);
2829 	q->q_ptr = WR(q)->q_ptr = connp;
2830 
2831 	connp->conn_dev = conn_dev;
2832 	connp->conn_minor_arena = minor_arena;
2833 
2834 	ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6);
2835 	ASSERT(WR(q)->q_qinfo == &tcp_winit);
2836 
2837 	tcp = connp->conn_tcp;
2838 
2839 	if (issocket) {
2840 		WR(q)->q_qinfo = &tcp_sock_winit;
2841 	} else {
2842 #ifdef  _ILP32
2843 		tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
2844 #else
2845 		tcp->tcp_acceptor_id = conn_dev;
2846 #endif  /* _ILP32 */
2847 		tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
2848 	}
2849 
2850 	/*
2851 	 * Put the ref for TCP. Ref for IP was already put
2852 	 * by ipcl_conn_create. Also Make the conn_t globally
2853 	 * visible to walkers
2854 	 */
2855 	mutex_enter(&connp->conn_lock);
2856 	CONN_INC_REF_LOCKED(connp);
2857 	ASSERT(connp->conn_ref == 2);
2858 	connp->conn_state_flags &= ~CONN_INCIPIENT;
2859 	mutex_exit(&connp->conn_lock);
2860 
2861 	qprocson(q);
2862 	return (0);
2863 }
2864 
2865 /*
2866  * Build/update the tcp header template (in conn_ht_iphc) based on
2867  * conn_xmit_ipp. The headers include ip6_t, any extension
2868  * headers, and the maximum size tcp header (to avoid reallocation
2869  * on the fly for additional tcp options).
2870  *
2871  * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}.
2872  * Returns failure if can't allocate memory.
2873  */
2874 int
tcp_build_hdrs(tcp_t * tcp)2875 tcp_build_hdrs(tcp_t *tcp)
2876 {
2877 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2878 	conn_t		*connp = tcp->tcp_connp;
2879 	char		buf[TCP_MAX_HDR_LENGTH];
2880 	uint_t		buflen;
2881 	uint_t		ulplen = TCP_MIN_HEADER_LENGTH;
2882 	uint_t		extralen = TCP_MAX_TCP_OPTIONS_LENGTH;
2883 	tcpha_t		*tcpha;
2884 	uint32_t	cksum;
2885 	int		error;
2886 
2887 	/*
2888 	 * We might be called after the connection is set up, and we might
2889 	 * have TS options already in the TCP header. Thus we  save any
2890 	 * existing tcp header.
2891 	 */
2892 	buflen = connp->conn_ht_ulp_len;
2893 	if (buflen != 0) {
2894 		bcopy(connp->conn_ht_ulp, buf, buflen);
2895 		extralen -= buflen - ulplen;
2896 		ulplen = buflen;
2897 	}
2898 
2899 	/* Grab lock to satisfy ASSERT; TCP is serialized using squeue */
2900 	mutex_enter(&connp->conn_lock);
2901 	error = conn_build_hdr_template(connp, ulplen, extralen,
2902 	    &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo);
2903 	mutex_exit(&connp->conn_lock);
2904 	if (error != 0)
2905 		return (error);
2906 
2907 	/*
2908 	 * Any routing header/option has been massaged. The checksum difference
2909 	 * is stored in conn_sum for later use.
2910 	 */
2911 	tcpha = (tcpha_t *)connp->conn_ht_ulp;
2912 	tcp->tcp_tcpha = tcpha;
2913 
2914 	/* restore any old tcp header */
2915 	if (buflen != 0) {
2916 		bcopy(buf, connp->conn_ht_ulp, buflen);
2917 	} else {
2918 		tcpha->tha_sum = 0;
2919 		tcpha->tha_urp = 0;
2920 		tcpha->tha_ack = 0;
2921 		tcpha->tha_offset_and_reserved = (5 << 4);
2922 		tcpha->tha_lport = connp->conn_lport;
2923 		tcpha->tha_fport = connp->conn_fport;
2924 	}
2925 
2926 	/*
2927 	 * IP wants our header length in the checksum field to
2928 	 * allow it to perform a single pseudo-header+checksum
2929 	 * calculation on behalf of TCP.
2930 	 * Include the adjustment for a source route once IP_OPTIONS is set.
2931 	 */
2932 	cksum = sizeof (tcpha_t) + connp->conn_sum;
2933 	cksum = (cksum >> 16) + (cksum & 0xFFFF);
2934 	ASSERT(cksum < 0x10000);
2935 	tcpha->tha_sum = htons(cksum);
2936 
2937 	if (connp->conn_ipversion == IPV4_VERSION)
2938 		tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc;
2939 	else
2940 		tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc;
2941 
2942 	if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra >
2943 	    connp->conn_wroff) {
2944 		connp->conn_wroff = connp->conn_ht_iphc_allocated +
2945 		    tcps->tcps_wroff_xtra;
2946 		(void) proto_set_tx_wroff(connp->conn_rq, connp,
2947 		    connp->conn_wroff);
2948 	}
2949 	return (0);
2950 }
2951 
2952 /*
2953  * tcp_rwnd_set() is called to adjust the receive window to a desired value.
2954  * We do not allow the receive window to shrink.  After setting rwnd,
2955  * set the flow control hiwat of the stream.
2956  *
2957  * This function is called in 2 cases:
2958  *
2959  * 1) Before data transfer begins, in tcp_input_listener() for accepting a
2960  *    connection (passive open) and in tcp_input_data() for active connect.
2961  *    This is called after tcp_mss_set() when the desired MSS value is known.
2962  *    This makes sure that our window size is a mutiple of the other side's
2963  *    MSS.
2964  * 2) Handling SO_RCVBUF option.
2965  *
2966  * It is ASSUMED that the requested size is a multiple of the current MSS.
2967  *
2968  * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
2969  * user requests so.
2970  */
2971 int
tcp_rwnd_set(tcp_t * tcp,uint32_t rwnd)2972 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
2973 {
2974 	uint32_t	mss = tcp->tcp_mss;
2975 	uint32_t	old_max_rwnd;
2976 	uint32_t	max_transmittable_rwnd;
2977 	boolean_t	tcp_detached = TCP_IS_DETACHED(tcp);
2978 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2979 	conn_t		*connp = tcp->tcp_connp;
2980 
2981 	/*
2982 	 * Insist on a receive window that is at least
2983 	 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
2984 	 * funny TCP interactions of Nagle algorithm, SWS avoidance
2985 	 * and delayed acknowledgement.
2986 	 */
2987 	rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss);
2988 
2989 	if (tcp->tcp_fused) {
2990 		size_t sth_hiwat;
2991 		tcp_t *peer_tcp = tcp->tcp_loopback_peer;
2992 
2993 		ASSERT(peer_tcp != NULL);
2994 		sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd);
2995 		if (!tcp_detached) {
2996 			(void) proto_set_rx_hiwat(connp->conn_rq, connp,
2997 			    sth_hiwat);
2998 			tcp_set_recv_threshold(tcp, sth_hiwat >> 3);
2999 		}
3000 
3001 		/* Caller could have changed tcp_rwnd; update tha_win */
3002 		if (tcp->tcp_tcpha != NULL) {
3003 			tcp->tcp_tcpha->tha_win =
3004 			    htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3005 		}
3006 		if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3007 			tcp->tcp_cwnd_max = rwnd;
3008 
3009 		/*
3010 		 * In the fusion case, the maxpsz stream head value of
3011 		 * our peer is set according to its send buffer size
3012 		 * and our receive buffer size; since the latter may
3013 		 * have changed we need to update the peer's maxpsz.
3014 		 */
3015 		(void) tcp_maxpsz_set(peer_tcp, B_TRUE);
3016 		return (sth_hiwat);
3017 	}
3018 
3019 	if (tcp_detached)
3020 		old_max_rwnd = tcp->tcp_rwnd;
3021 	else
3022 		old_max_rwnd = connp->conn_rcvbuf;
3023 
3024 
3025 	/*
3026 	 * If window size info has already been exchanged, TCP should not
3027 	 * shrink the window.  Shrinking window is doable if done carefully.
3028 	 * We may add that support later.  But so far there is not a real
3029 	 * need to do that.
3030 	 */
3031 	if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
3032 		/* MSS may have changed, do a round up again. */
3033 		rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
3034 	}
3035 
3036 	/*
3037 	 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
3038 	 * can be applied even before the window scale option is decided.
3039 	 */
3040 	max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
3041 	if (rwnd > max_transmittable_rwnd) {
3042 		rwnd = max_transmittable_rwnd -
3043 		    (max_transmittable_rwnd % mss);
3044 		if (rwnd < mss)
3045 			rwnd = max_transmittable_rwnd;
3046 		/*
3047 		 * If we're over the limit we may have to back down tcp_rwnd.
3048 		 * The increment below won't work for us. So we set all three
3049 		 * here and the increment below will have no effect.
3050 		 */
3051 		tcp->tcp_rwnd = old_max_rwnd = rwnd;
3052 	}
3053 	if (tcp->tcp_localnet) {
3054 		tcp->tcp_rack_abs_max =
3055 		    MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2);
3056 	} else {
3057 		/*
3058 		 * For a remote host on a different subnet (through a router),
3059 		 * we ack every other packet to be conforming to RFC1122.
3060 		 * tcp_deferred_acks_max is default to 2.
3061 		 */
3062 		tcp->tcp_rack_abs_max =
3063 		    MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2);
3064 	}
3065 	if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max)
3066 		tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
3067 	else
3068 		tcp->tcp_rack_cur_max = 0;
3069 	/*
3070 	 * Increment the current rwnd by the amount the maximum grew (we
3071 	 * can not overwrite it since we might be in the middle of a
3072 	 * connection.)
3073 	 */
3074 	tcp->tcp_rwnd += rwnd - old_max_rwnd;
3075 	connp->conn_rcvbuf = rwnd;
3076 
3077 	/* Are we already connected? */
3078 	if (tcp->tcp_tcpha != NULL) {
3079 		tcp->tcp_tcpha->tha_win =
3080 		    htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3081 	}
3082 
3083 	if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3084 		tcp->tcp_cwnd_max = rwnd;
3085 
3086 	if (tcp_detached)
3087 		return (rwnd);
3088 
3089 	tcp_set_recv_threshold(tcp, rwnd >> 3);
3090 
3091 	(void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd);
3092 	return (rwnd);
3093 }
3094 
3095 int
tcp_do_unbind(conn_t * connp)3096 tcp_do_unbind(conn_t *connp)
3097 {
3098 	tcp_t *tcp = connp->conn_tcp;
3099 	int32_t oldstate;
3100 
3101 	switch (tcp->tcp_state) {
3102 	case TCPS_BOUND:
3103 	case TCPS_LISTEN:
3104 		break;
3105 	default:
3106 		return (-TOUTSTATE);
3107 	}
3108 
3109 	/*
3110 	 * Need to clean up all the eagers since after the unbind, segments
3111 	 * will no longer be delivered to this listener stream.
3112 	 */
3113 	mutex_enter(&tcp->tcp_eager_lock);
3114 	if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
3115 		tcp_eager_cleanup(tcp, 0);
3116 	}
3117 	mutex_exit(&tcp->tcp_eager_lock);
3118 
3119 	/* Clean up the listener connection counter if necessary. */
3120 	if (tcp->tcp_listen_cnt != NULL)
3121 		TCP_DECR_LISTEN_CNT(tcp);
3122 	connp->conn_laddr_v6 = ipv6_all_zeros;
3123 	connp->conn_saddr_v6 = ipv6_all_zeros;
3124 	tcp_bind_hash_remove(tcp);
3125 	oldstate = tcp->tcp_state;
3126 	tcp->tcp_state = TCPS_IDLE;
3127 	DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3128 	    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3129 	    int32_t, oldstate);
3130 
3131 	ip_unbind(connp);
3132 	bzero(&connp->conn_ports, sizeof (connp->conn_ports));
3133 
3134 	return (0);
3135 }
3136 
3137 /*
3138  * Collect protocol properties to send to the upper handle.
3139  */
3140 void
tcp_get_proto_props(tcp_t * tcp,struct sock_proto_props * sopp)3141 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp)
3142 {
3143 	conn_t *connp = tcp->tcp_connp;
3144 
3145 	sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF;
3146 	sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE);
3147 
3148 	sopp->sopp_rxhiwat = tcp->tcp_fused ?
3149 	    tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) :
3150 	    connp->conn_rcvbuf;
3151 	/*
3152 	 * Determine what write offset value to use depending on SACK and
3153 	 * whether the endpoint is fused or not.
3154 	 */
3155 	if (tcp->tcp_fused) {
3156 		ASSERT(tcp->tcp_loopback);
3157 		ASSERT(tcp->tcp_loopback_peer != NULL);
3158 		/*
3159 		 * For fused tcp loopback, set the stream head's write
3160 		 * offset value to zero since we won't be needing any room
3161 		 * for TCP/IP headers.  This would also improve performance
3162 		 * since it would reduce the amount of work done by kmem.
3163 		 * Non-fused tcp loopback case is handled separately below.
3164 		 */
3165 		sopp->sopp_wroff = 0;
3166 		/*
3167 		 * Update the peer's transmit parameters according to
3168 		 * our recently calculated high water mark value.
3169 		 */
3170 		(void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE);
3171 	} else if (tcp->tcp_snd_sack_ok) {
3172 		sopp->sopp_wroff = connp->conn_ht_iphc_allocated +
3173 		    (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3174 	} else {
3175 		sopp->sopp_wroff = connp->conn_ht_iphc_len +
3176 		    (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3177 	}
3178 
3179 	if (tcp->tcp_loopback) {
3180 		sopp->sopp_flags |= SOCKOPT_LOOPBACK;
3181 		sopp->sopp_loopback = B_TRUE;
3182 	}
3183 }
3184 
3185 /*
3186  * Check the usability of ZEROCOPY. It's instead checking the flag set by IP.
3187  */
3188 boolean_t
tcp_zcopy_check(tcp_t * tcp)3189 tcp_zcopy_check(tcp_t *tcp)
3190 {
3191 	conn_t		*connp = tcp->tcp_connp;
3192 	ip_xmit_attr_t	*ixa = connp->conn_ixa;
3193 	boolean_t	zc_enabled = B_FALSE;
3194 	tcp_stack_t	*tcps = tcp->tcp_tcps;
3195 
3196 	if (do_tcpzcopy == 2)
3197 		zc_enabled = B_TRUE;
3198 	else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB))
3199 		zc_enabled = B_TRUE;
3200 
3201 	tcp->tcp_snd_zcopy_on = zc_enabled;
3202 	if (!TCP_IS_DETACHED(tcp)) {
3203 		if (zc_enabled) {
3204 			ixa->ixa_flags |= IXAF_VERIFY_ZCOPY;
3205 			(void) proto_set_tx_copyopt(connp->conn_rq, connp,
3206 			    ZCVMSAFE);
3207 			TCP_STAT(tcps, tcp_zcopy_on);
3208 		} else {
3209 			ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY;
3210 			(void) proto_set_tx_copyopt(connp->conn_rq, connp,
3211 			    ZCVMUNSAFE);
3212 			TCP_STAT(tcps, tcp_zcopy_off);
3213 		}
3214 	}
3215 	return (zc_enabled);
3216 }
3217 
3218 /*
3219  * Backoff from a zero-copy message by copying data to a new allocated
3220  * message and freeing the original desballoca'ed segmapped message.
3221  *
3222  * This function is called by following two callers:
3223  * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free
3224  *    the origial desballoca'ed message and notify sockfs. This is in re-
3225  *    transmit state.
3226  * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need
3227  *    to be copied to new message.
3228  */
3229 mblk_t *
tcp_zcopy_backoff(tcp_t * tcp,mblk_t * bp,boolean_t fix_xmitlist)3230 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist)
3231 {
3232 	mblk_t		*nbp;
3233 	mblk_t		*head = NULL;
3234 	mblk_t		*tail = NULL;
3235 	tcp_stack_t	*tcps = tcp->tcp_tcps;
3236 
3237 	ASSERT(bp != NULL);
3238 	while (bp != NULL) {
3239 		if (IS_VMLOANED_MBLK(bp)) {
3240 			TCP_STAT(tcps, tcp_zcopy_backoff);
3241 			if ((nbp = copyb(bp)) == NULL) {
3242 				tcp->tcp_xmit_zc_clean = B_FALSE;
3243 				if (tail != NULL)
3244 					tail->b_cont = bp;
3245 				return ((head == NULL) ? bp : head);
3246 			}
3247 
3248 			if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
3249 				if (fix_xmitlist)
3250 					tcp_zcopy_notify(tcp);
3251 				else
3252 					nbp->b_datap->db_struioflag |=
3253 					    STRUIO_ZCNOTIFY;
3254 			}
3255 			nbp->b_cont = bp->b_cont;
3256 
3257 			/*
3258 			 * Copy saved information and adjust tcp_xmit_tail
3259 			 * if needed.
3260 			 */
3261 			if (fix_xmitlist) {
3262 				nbp->b_prev = bp->b_prev;
3263 				nbp->b_next = bp->b_next;
3264 
3265 				if (tcp->tcp_xmit_tail == bp)
3266 					tcp->tcp_xmit_tail = nbp;
3267 			}
3268 
3269 			/* Free the original message. */
3270 			bp->b_prev = NULL;
3271 			bp->b_next = NULL;
3272 			freeb(bp);
3273 
3274 			bp = nbp;
3275 		}
3276 
3277 		if (head == NULL) {
3278 			head = bp;
3279 		}
3280 		if (tail == NULL) {
3281 			tail = bp;
3282 		} else {
3283 			tail->b_cont = bp;
3284 			tail = bp;
3285 		}
3286 
3287 		/* Move forward. */
3288 		bp = bp->b_cont;
3289 	}
3290 
3291 	if (fix_xmitlist) {
3292 		tcp->tcp_xmit_last = tail;
3293 		tcp->tcp_xmit_zc_clean = B_TRUE;
3294 	}
3295 
3296 	return (head);
3297 }
3298 
3299 void
tcp_zcopy_notify(tcp_t * tcp)3300 tcp_zcopy_notify(tcp_t *tcp)
3301 {
3302 	struct stdata	*stp;
3303 	conn_t		*connp;
3304 
3305 	if (tcp->tcp_detached)
3306 		return;
3307 	connp = tcp->tcp_connp;
3308 	if (IPCL_IS_NONSTR(connp)) {
3309 		(*connp->conn_upcalls->su_zcopy_notify)
3310 		    (connp->conn_upper_handle);
3311 		return;
3312 	}
3313 	stp = STREAM(connp->conn_rq);
3314 	mutex_enter(&stp->sd_lock);
3315 	stp->sd_flag |= STZCNOTIFY;
3316 	cv_broadcast(&stp->sd_zcopy_wait);
3317 	mutex_exit(&stp->sd_lock);
3318 }
3319 
3320 /*
3321  * Update the TCP connection according to change of LSO capability.
3322  */
3323 static void
tcp_update_lso(tcp_t * tcp,ip_xmit_attr_t * ixa)3324 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa)
3325 {
3326 	/*
3327 	 * We check against IPv4 header length to preserve the old behavior
3328 	 * of only enabling LSO when there are no IP options.
3329 	 * But this restriction might not be necessary at all. Before removing
3330 	 * it, need to verify how LSO is handled for source routing case, with
3331 	 * which IP does software checksum.
3332 	 *
3333 	 * For IPv6, whenever any extension header is needed, LSO is supressed.
3334 	 */
3335 	if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ?
3336 	    IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN))
3337 		return;
3338 
3339 	/*
3340 	 * Either the LSO capability newly became usable, or it has changed.
3341 	 */
3342 	if (ixa->ixa_flags & IXAF_LSO_CAPAB) {
3343 		ill_lso_capab_t	*lsoc = &ixa->ixa_lso_capab;
3344 		uint_t lso_max = (ixa->ixa_flags & IXAF_IS_IPV4) ?
3345 		    lsoc->ill_lso_max_tcpv4 : lsoc->ill_lso_max_tcpv6;
3346 
3347 		ASSERT3U(lso_max, >, 0);
3348 		tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lso_max);
3349 
3350 		DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3351 		    boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max);
3352 
3353 		/*
3354 		 * If LSO to be enabled, notify the STREAM header with larger
3355 		 * data block.
3356 		 */
3357 		if (!tcp->tcp_lso)
3358 			tcp->tcp_maxpsz_multiplier = 0;
3359 
3360 		tcp->tcp_lso = B_TRUE;
3361 		TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled);
3362 	} else { /* LSO capability is not usable any more. */
3363 		DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3364 		    boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max);
3365 
3366 		/*
3367 		 * If LSO to be disabled, notify the STREAM header with smaller
3368 		 * data block. And need to restore fragsize to PMTU.
3369 		 */
3370 		if (tcp->tcp_lso) {
3371 			tcp->tcp_maxpsz_multiplier =
3372 			    tcp->tcp_tcps->tcps_maxpsz_multiplier;
3373 			ixa->ixa_fragsize = ixa->ixa_pmtu;
3374 			tcp->tcp_lso = B_FALSE;
3375 			TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled);
3376 		}
3377 	}
3378 
3379 	(void) tcp_maxpsz_set(tcp, B_TRUE);
3380 }
3381 
3382 /*
3383  * Update the TCP connection according to change of ZEROCOPY capability.
3384  */
3385 static void
tcp_update_zcopy(tcp_t * tcp)3386 tcp_update_zcopy(tcp_t *tcp)
3387 {
3388 	conn_t		*connp = tcp->tcp_connp;
3389 	tcp_stack_t	*tcps = tcp->tcp_tcps;
3390 
3391 	if (tcp->tcp_snd_zcopy_on) {
3392 		tcp->tcp_snd_zcopy_on = B_FALSE;
3393 		if (!TCP_IS_DETACHED(tcp)) {
3394 			(void) proto_set_tx_copyopt(connp->conn_rq, connp,
3395 			    ZCVMUNSAFE);
3396 			TCP_STAT(tcps, tcp_zcopy_off);
3397 		}
3398 	} else {
3399 		tcp->tcp_snd_zcopy_on = B_TRUE;
3400 		if (!TCP_IS_DETACHED(tcp)) {
3401 			(void) proto_set_tx_copyopt(connp->conn_rq, connp,
3402 			    ZCVMSAFE);
3403 			TCP_STAT(tcps, tcp_zcopy_on);
3404 		}
3405 	}
3406 }