1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/stream.h>
32 #include <sys/cmn_err.h>
33 #include <sys/strsubr.h>
34 #include <sys/strsun.h>
35 
36 #include <netinet/in.h>
37 #include <netinet/ip6.h>
38 
39 #include <inet/common.h>
40 #include <inet/ip.h>
41 #include <inet/mib2.h>
42 #include <inet/ipclassifier.h>
43 #include "sctp_impl.h"
44 #include "sctp_asconf.h"
45 
46 /* Timer block states. */
47 typedef enum {
48 	SCTP_TB_RUNNING = 1,
49 	SCTP_TB_IDLE,
50 /* Could not stop/free before mblk got queued */
51 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
52 	SCTP_TB_CANCELLED,
53 	SCTP_TB_TO_BE_FREED
54 } timer_block_state;
55 
56 typedef struct sctp_tb_s {
57 	timer_block_state	sctp_tb_state;
58 	timeout_id_t		sctp_tb_tid;
59 	mblk_t			*sctp_tb_mp;
60 	clock_t			sctp_tb_time_left;
61 } sctp_tb_t;
62 
63 static void sctp_timer_fire(sctp_tb_t *);
64 
65 /*
66  *		sctp_timer mechanism.
67  *
68  * Each timer is represented by a timer mblk. When the
69  * timer fires, and the sctp_t is busy, the timer mblk will be put on
70  * the associated sctp_t timer queue so that it can be executed when
71  * the thread holding the lock on the sctp_t is done with its job.
72  *
73  * Note that there is no lock to protect the timer mblk state.  The reason
74  * is that the timer state can only be changed by a thread holding the
75  * lock on the sctp_t.
76  *
77  * The interface consists of 4 entry points:
78  *	sctp_timer_alloc	- create a timer mblk
79  *	sctp_timer_free		- free a timer mblk
80  *	sctp_timer		- start, restart, stop the timer
81  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
82  *				  the timer did indeed fire.
83  */
84 
85 
86 /*
87  * Start, restart, stop the timer.
88  * If "tim" is -1 the timer is stopped.
89  * Otherwise, the timer is stopped if it is already running, and
90  * set to fire tim clock ticks from now.
91  */
92 void
93 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
94 {
95 	sctp_tb_t *sctp_tb;
96 	int state;
97 
98 	ASSERT(sctp != NULL && mp != NULL);
99 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
100 	ASSERT(mp->b_datap->db_type == M_PCSIG);
101 
102 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
103 	if (tim >= 0) {
104 		state = sctp_tb->sctp_tb_state;
105 		sctp_tb->sctp_tb_time_left = tim;
106 		if (state == SCTP_TB_RUNNING) {
107 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
108 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
109 				/* sctp_timer_valid will start timer */
110 				return;
111 			}
112 		} else if (state != SCTP_TB_IDLE) {
113 			ASSERT(state != SCTP_TB_TO_BE_FREED);
114 			if (state == SCTP_TB_CANCELLED) {
115 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
116 				/* sctp_timer_valid will start timer */
117 				return;
118 			}
119 			if (state == SCTP_TB_RESCHED) {
120 				/* sctp_timer_valid will start timer */
121 				return;
122 			}
123 		} else {
124 			SCTP_REFHOLD(sctp);
125 		}
126 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
127 		sctp_tb->sctp_tb_tid =
128 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
129 		return;
130 	}
131 	switch (tim) {
132 	case -1:
133 		sctp_timer_stop(mp);
134 		break;
135 	default:
136 		ASSERT(0);
137 		break;
138 	}
139 }
140 
141 /*
142  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
143  * sctp timer.
144  *
145  * Allocate an M_PCSIG timer message. The space between db_base and
146  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
147  * space for sctpt_t.
148  */
149 mblk_t *
150 sctp_timer_alloc(sctp_t *sctp, pfv_t func, int sleep)
151 {
152 	mblk_t *mp;
153 	sctp_tb_t *sctp_tb;
154 	sctpt_t	*sctpt;
155 	sctp_stack_t	*sctps = sctp->sctp_sctps;
156 
157 	if (sleep == KM_SLEEP) {
158 		mp = allocb_wait(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI,
159 		    STR_NOSIG, NULL);
160 	} else {
161 		mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI);
162 	}
163 	if (mp != NULL) {
164 		mp->b_datap->db_type = M_PCSIG;
165 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
166 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
167 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
168 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
169 		sctp_tb->sctp_tb_mp = mp;
170 
171 		sctpt = (sctpt_t *)mp->b_rptr;
172 		sctpt->sctpt_sctp = sctp;
173 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
174 		sctpt->sctpt_pfv = func;
175 		return (mp);
176 	}
177 	SCTP_KSTAT(sctps, sctp_add_timer);
178 	return (NULL);
179 }
180 
181 /*
182  * timeout() callback function.
183  * Put the message on the process control block's queue.
184  * If the timer is stopped or freed after
185  * it has fired then sctp_timer() and sctp_timer_valid() will clean
186  * things up.
187  */
188 static void
189 sctp_timer_fire(sctp_tb_t *sctp_tb)
190 {
191 	mblk_t *mp;
192 	sctp_t *sctp;
193 	sctpt_t *sctpt;
194 
195 	mp = sctp_tb->sctp_tb_mp;
196 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
197 	ASSERT(mp->b_datap->db_type == M_PCSIG);
198 
199 	sctpt = (sctpt_t *)mp->b_rptr;
200 	sctp = sctpt->sctpt_sctp;
201 	ASSERT(sctp != NULL);
202 
203 	mutex_enter(&sctp->sctp_lock);
204 	if (sctp->sctp_running) {
205 		/*
206 		 * Put the timer mblk to the special sctp_timer_mp list.
207 		 * This timer will be handled when the thread using this
208 		 * SCTP is done with its job.
209 		 */
210 		if (sctp->sctp_timer_mp == NULL) {
211 			SCTP_REFHOLD(sctp);
212 			sctp->sctp_timer_mp = mp;
213 		} else {
214 			linkb(sctp->sctp_timer_mp, mp);
215 		}
216 		mp->b_cont = NULL;
217 		mutex_exit(&sctp->sctp_lock);
218 	} else {
219 		sctp->sctp_running = B_TRUE;
220 		mutex_exit(&sctp->sctp_lock);
221 
222 		sctp_timer_call(sctp, mp);
223 		WAKE_SCTP(sctp);
224 		sctp_process_sendq(sctp);
225 	}
226 	SCTP_REFRELE(sctp);
227 }
228 
229 /*
230  * Logically free a timer mblk (that might have a pending timeout().)
231  * If the timer has fired and the mblk has been put on the queue then
232  * sctp_timer_valid will free the mblk.
233  */
234 void
235 sctp_timer_free(mblk_t *mp)
236 {
237 	sctp_tb_t *sctp_tb;
238 	int state;
239 	sctpt_t *sctpt;
240 
241 	ASSERT(mp != NULL);
242 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
243 	ASSERT(mp->b_datap->db_type == M_PCSIG);
244 
245 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
246 	state = sctp_tb->sctp_tb_state;
247 
248 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
249 
250 	if (state == SCTP_TB_RUNNING) {
251 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
252 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
253 			/* sctp_timer_valid will free the mblk */
254 			return;
255 		}
256 		sctpt = (sctpt_t *)mp->b_rptr;
257 		SCTP_REFRELE(sctpt->sctpt_sctp);
258 	} else if (state != SCTP_TB_IDLE) {
259 		ASSERT(state != SCTP_TB_TO_BE_FREED);
260 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
261 		/* sctp_timer_valid will free the mblk */
262 		return;
263 	}
264 	freeb(mp);
265 }
266 
267 /*
268  * Called from sctp_timer(,,-1)
269  */
270 void
271 sctp_timer_stop(mblk_t *mp)
272 {
273 	sctp_tb_t *sctp_tb;
274 	int state;
275 	sctpt_t *sctpt;
276 
277 	ASSERT(mp != NULL);
278 	ASSERT(mp->b_datap->db_type == M_PCSIG);
279 
280 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
281 	state = sctp_tb->sctp_tb_state;
282 
283 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
284 
285 	if (state == SCTP_TB_RUNNING) {
286 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
287 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
288 		} else {
289 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
290 			sctpt = (sctpt_t *)mp->b_rptr;
291 			SCTP_REFRELE(sctpt->sctpt_sctp);
292 		}
293 	} else if (state == SCTP_TB_RESCHED) {
294 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
295 	}
296 }
297 
298 /*
299  * The user of the sctp_timer mechanism is required to call
300  * sctp_timer_valid() for each M_PCSIG message processed in the
301  * service procedures.
302  * sctp_timer_valid will return "true" if the timer actually did fire.
303  */
304 
305 static boolean_t
306 sctp_timer_valid(mblk_t *mp)
307 {
308 	sctp_tb_t *sctp_tb;
309 	int state;
310 	sctpt_t *sctpt;
311 
312 	ASSERT(mp != NULL);
313 	ASSERT(mp->b_datap->db_type == M_PCSIG);
314 
315 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
316 	sctpt = (sctpt_t *)mp->b_rptr;
317 	state = sctp_tb->sctp_tb_state;
318 	if (state != SCTP_TB_RUNNING) {
319 		ASSERT(state != SCTP_TB_IDLE);
320 		if (state == SCTP_TB_TO_BE_FREED) {
321 			/*
322 			 * sctp_timer_free was called after the message
323 			 * was putq'ed.
324 			 */
325 			freeb(mp);
326 			return (B_FALSE);
327 		}
328 		if (state == SCTP_TB_CANCELLED) {
329 			/* The timer was stopped after the mblk was putq'ed */
330 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
331 			return (B_FALSE);
332 		}
333 		if (state == SCTP_TB_RESCHED) {
334 			/*
335 			 * The timer was stopped and then restarted after
336 			 * the mblk was putq'ed.
337 			 * sctp_tb_time_left contains the number of ticks that
338 			 * the timer was restarted with.
339 			 * The sctp will not be disapper between the time
340 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
341 			 * we get here as sctp_add_recvq() does a refhold.
342 			 */
343 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
344 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
345 			    sctp_tb, sctp_tb->sctp_tb_time_left);
346 			SCTP_REFHOLD(sctpt->sctpt_sctp);
347 			return (B_FALSE);
348 		}
349 	}
350 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
351 	return (B_TRUE);
352 }
353 
354 /*
355  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
356  * timer was cancelled or not.
357  */
358 void
359 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
360 {
361 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
362 
363 	if (sctp_timer_valid(mp)) {
364 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
365 	}
366 }
367 
368 /*
369  * Delayed ack
370  */
371 void
372 sctp_ack_timer(sctp_t *sctp)
373 {
374 	sctp_stack_t	*sctps = sctp->sctp_sctps;
375 
376 	sctp->sctp_ack_timer_running = 0;
377 	sctp->sctp_sack_toggle = sctps->sctps_deferred_acks_max;
378 	BUMP_MIB(&sctps->sctps_mib, sctpOutAckDelayed);
379 	sctp_sack(sctp, NULL);
380 }
381 
382 /*
383  * Peer address heartbeat timer handler
384  */
385 void
386 sctp_heartbeat_timer(sctp_t *sctp)
387 {
388 	sctp_faddr_t	*fp;
389 	int64_t		now;
390 	int64_t		earliest_expiry;
391 	int		cnt;
392 	sctp_stack_t	*sctps = sctp->sctp_sctps;
393 
394 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
395 		/*
396 		 * If there is a peer address with no strikes,
397 		 * don't give up yet. If enough other peer
398 		 * address are down, we could otherwise fail
399 		 * the association prematurely.  This is a
400 		 * byproduct of our aggressive probe approach
401 		 * when a heartbeat fails to connect. We may
402 		 * wish to revisit this...
403 		 */
404 		if (!sctp_is_a_faddr_clean(sctp)) {
405 			/* time to give up */
406 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
407 			BUMP_MIB(&sctps->sctps_mib, sctpTimHeartBeatDrop);
408 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
409 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
410 			    sctp->sctp_client_errno : ETIMEDOUT);
411 			return;
412 		}
413 	}
414 
415 	/* Only send heartbeats in the established state */
416 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
417 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
418 		return;
419 	}
420 
421 	now = lbolt64;
422 	earliest_expiry = 0;
423 	cnt = sctps->sctps_maxburst;
424 
425 	/*
426 	 * Walk through all faddrs.  Since the timer should run infrequently
427 	 * and the number of peer addresses should not be big, this should
428 	 * be OK.
429 	 */
430 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
431 		/*
432 		 * Don't send heartbeat to this address if
433 		 * 1. it is not reachable OR
434 		 * 2. hb_interval == 0 and the address has been confirmed.
435 		 */
436 		if (fp->state == SCTP_FADDRS_UNREACH ||
437 		    (fp->hb_interval == 0 &&
438 		    fp->state != SCTP_FADDRS_UNCONFIRMED)) {
439 			continue;
440 		}
441 
442 		/*
443 		 * The heartbeat timer is expired.  If the address is dead,
444 		 * we still send heartbeat to it in case it becomes alive
445 		 * again.  But we will only send once every hb_interval.
446 		 *
447 		 * If the address is alive and there is a hearbeat pending,
448 		 * resend the heartbeat and start exponential backoff on the
449 		 * heartbeat timeout value.  If there is no heartbeat pending,
450 		 * just send out one.
451 		 */
452 		if (now >= fp->hb_expiry) {
453 			if (fp->hb_pending) {
454 				/*
455 				 * If an address is not confirmed, no need
456 				 * to bump the overall counter as it doesn't
457 				 * matter as we will not use it to send data
458 				 * and it should not affect the association.
459 				 */
460 				switch (fp->state) {
461 				case SCTP_FADDRS_ALIVE:
462 					sctp->sctp_strikes++;
463 					/* FALLTHRU */
464 				case SCTP_FADDRS_UNCONFIRMED:
465 					/*
466 					 * Retransmission implies that RTO
467 					 * is probably not correct.
468 					 */
469 					fp->rtt_updates = 0;
470 					fp->strikes++;
471 					if (fp->strikes > fp->max_retr) {
472 						if (sctp_faddr_dead(sctp, fp,
473 						    SCTP_FADDRS_DOWN) == -1) {
474 							/* Assoc is dead */
475 							return;
476 						}
477 						/*
478 						 * Addr is down; keep initial
479 						 * RTO
480 						 */
481 						fp->rto =
482 						    sctp->sctp_rto_initial;
483 						goto dead_addr;
484 					} else {
485 						SCTP_CALC_RXT(fp,
486 						    sctp->sctp_rto_max);
487 						fp->hb_expiry = now + fp->rto;
488 					}
489 					break;
490 				case SCTP_FADDRS_DOWN:
491 dead_addr:
492 					fp->hb_expiry = now + SET_HB_INTVL(fp);
493 					break;
494 				default:
495 					continue;
496 				}
497 			} else {
498 				fp->hb_expiry = now + fp->rto;
499 			}
500 			/*
501 			 * Note that the total number of heartbeat we can send
502 			 * out simultaneously is limited by sctp_maxburst.  If
503 			 * the limit is exceeded, we need to wait for the next
504 			 * timeout to send them.  This should only happen if
505 			 * there is unconfirmed address.  Note that hb_pending
506 			 * is set in sctp_send_heartbeat().  So if a heartbeat
507 			 * is not sent, it will not affect the state of the
508 			 * peer address.
509 			 */
510 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
511 				sctp_send_heartbeat(sctp, fp);
512 		}
513 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
514 			earliest_expiry = fp->hb_expiry;
515 	}
516 	if (sctp->sctp_autoclose != 0) {
517 		int64_t expire;
518 
519 		expire = sctp->sctp_active + sctp->sctp_autoclose;
520 
521 		if (expire <= now) {
522 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
523 			sctp_send_shutdown(sctp, 0);
524 			return;
525 		}
526 		if (expire < earliest_expiry || earliest_expiry == 0)
527 			earliest_expiry = expire;
528 	}
529 
530 	earliest_expiry -= now;
531 	if (earliest_expiry < 0)
532 		earliest_expiry = 1;
533 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
534 }
535 
536 void
537 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
538 {
539 	mblk_t 		*mp;
540 	uint32_t	rto_max = sctp->sctp_rto_max;
541 	sctp_stack_t	*sctps = sctp->sctp_sctps;
542 
543 	ASSERT(fp != NULL);
544 
545 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
546 	    SCTP_PRINTADDR(fp->faddr)));
547 
548 	fp->timer_running = 0;
549 
550 	/* Check is we've reached the max for retries */
551 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
552 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
553 			/* time to give up */
554 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
555 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
556 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
557 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
558 			    sctp->sctp_client_errno : ETIMEDOUT);
559 			return;
560 		}
561 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
562 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
563 			/* time to give up */
564 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
565 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
566 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
567 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
568 			    sctp->sctp_client_errno : ETIMEDOUT);
569 			return;
570 		}
571 	}
572 
573 	if (fp->strikes >= fp->max_retr) {
574 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
575 			return;
576 		}
577 	}
578 
579 	switch (sctp->sctp_state) {
580 	case SCTPS_ESTABLISHED:
581 		/*
582 		 * Reset the heartbeat expiry time.  We don't need a heartbeat
583 		 * timer running if we are retransmitting.  Otherwise, the drop
584 		 * of heartbeat may just make this peer address to be marked
585 		 * dead faster as fp->strikes is also increased for heartbeat.
586 		 */
587 		fp->hb_expiry = lbolt64 + SET_HB_INTVL(fp);
588 		fp->hb_pending = B_FALSE;
589 
590 		/* FALLTHRU */
591 	case SCTPS_SHUTDOWN_PENDING:
592 	case SCTPS_SHUTDOWN_RECEIVED:
593 		if (sctp->sctp_state == SCTPS_SHUTDOWN_RECEIVED) {
594 			(void) sctp_shutdown_received(sctp, NULL, B_FALSE,
595 			    B_TRUE, NULL);
596 		}
597 
598 		if (sctp->sctp_xmit_head == NULL &&
599 		    sctp->sctp_xmit_unsent == NULL) {
600 			/* Nothing to retransmit */
601 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
602 				sctp_send_shutdown(sctp, 1);
603 			}
604 			return;
605 		}
606 
607 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
608 
609 		sctp_rexmit(sctp, fp);
610 		/*
611 		 * sctp_rexmit() will increase the strikes and restart the
612 		 * timer, so return here.
613 		 */
614 		return;
615 	case SCTPS_COOKIE_WAIT:
616 		BUMP_LOCAL(sctp->sctp_T1expire);
617 rxmit_init:
618 		/* retransmit init */
619 		/*
620 		 * We don't take the conn hash lock here since the source
621 		 * address list won't be modified (it would have been done
622 		 * the first time around).
623 		 */
624 		mp = sctp_init_mp(sctp);
625 		if (mp != NULL) {
626 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
627 			sctp_add_sendq(sctp, mp);
628 		}
629 		rto_max = sctp->sctp_init_rto_max;
630 		break;
631 	case SCTPS_COOKIE_ECHOED: {
632 		ipha_t *iph;
633 
634 		BUMP_LOCAL(sctp->sctp_T1expire);
635 		if (sctp->sctp_cookie_mp == NULL) {
636 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
637 			goto rxmit_init;
638 		}
639 		mp = dupmsg(sctp->sctp_cookie_mp);
640 		if (mp == NULL)
641 			break;
642 		iph = (ipha_t *)mp->b_rptr;
643 		/* Reset the IP ident. */
644 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
645 			iph->ipha_ident = 0;
646 		sctp_add_sendq(sctp, mp);
647 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
648 		rto_max = sctp->sctp_init_rto_max;
649 		break;
650 	}
651 	case SCTPS_SHUTDOWN_SENT:
652 		BUMP_LOCAL(sctp->sctp_T2expire);
653 		sctp_send_shutdown(sctp, 1);
654 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
655 		break;
656 	case SCTPS_SHUTDOWN_ACK_SENT:
657 		/* We shouldn't have any more outstanding data */
658 		ASSERT(sctp->sctp_xmit_head == NULL);
659 		ASSERT(sctp->sctp_xmit_unsent == NULL);
660 
661 		BUMP_LOCAL(sctp->sctp_T2expire);
662 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
663 		    NULL);
664 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
665 		break;
666 	default:
667 		ASSERT(0);
668 		break;
669 	}
670 
671 	fp->strikes++;
672 	sctp->sctp_strikes++;
673 	SCTP_CALC_RXT(fp, rto_max);
674 
675 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
676 }
677 
678 /*
679  * RTO calculation. timesent and now are both in ms.
680  */
681 void
682 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
683 {
684 	int rtt;
685 
686 	/* Calculate the RTT in ms */
687 	rtt = (int)delta;
688 	rtt = rtt > 0 ? rtt : 1;
689 
690 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
691 
692 	/* Is this the first RTT measurement? */
693 	if (fp->srtt == -1) {
694 		fp->srtt = rtt;
695 		fp->rttvar = rtt / 2;
696 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
697 	} else {
698 		int abs;
699 		/*
700 		 * Versions of the RTO equations that use fixed-point math.
701 		 * alpha and beta are NOT tunable in this implementation,
702 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
703 		 */
704 		abs = fp->srtt - rtt;
705 		abs = abs >= 0 ? abs : -abs;
706 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
707 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
708 
709 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
710 		fp->rto = fp->srtt + 4 * fp->rttvar;
711 	}
712 
713 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
714 	    fp->srtt, fp->rttvar, fp->rto));
715 
716 	/* Bound the RTO by configured min and max values */
717 	if (fp->rto < sctp->sctp_rto_min) {
718 		fp->rto = sctp->sctp_rto_min;
719 	}
720 	if (fp->rto > sctp->sctp_rto_max) {
721 		fp->rto = sctp->sctp_rto_max;
722 	}
723 
724 	fp->rtt_updates++;
725 }
726 
727 void
728 sctp_free_faddr_timers(sctp_t *sctp)
729 {
730 	sctp_faddr_t *fp;
731 
732 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
733 		if (fp->timer_mp != NULL) {
734 			sctp_timer_free(fp->timer_mp);
735 			fp->timer_mp = NULL;
736 			fp->timer_running = 0;
737 		}
738 		if (fp->rc_timer_mp != NULL) {
739 			sctp_timer_free(fp->rc_timer_mp);
740 			fp->rc_timer_mp = NULL;
741 			fp->rc_timer_running = 0;
742 		}
743 	}
744 }
745 
746 void
747 sctp_stop_faddr_timers(sctp_t *sctp)
748 {
749 	sctp_faddr_t *fp;
750 
751 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
752 		SCTP_FADDR_TIMER_STOP(fp);
753 		SCTP_FADDR_RC_TIMER_STOP(fp);
754 	}
755 }
756 
757 void
758 sctp_process_timer(sctp_t *sctp)
759 {
760 	mblk_t *mp;
761 
762 	ASSERT(sctp->sctp_running);
763 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
764 	while ((mp = sctp->sctp_timer_mp) != NULL) {
765 		ASSERT(DB_TYPE(mp) == M_PCSIG);
766 		/*
767 		 * Since the timer mblk can be freed in sctp_timer_call(),
768 		 * we need to grab the b_cont before that.
769 		 */
770 		sctp->sctp_timer_mp = mp->b_cont;
771 		mp->b_cont = NULL;
772 		sctp_timer_call(sctp, mp);
773 	}
774 	SCTP_REFRELE(sctp);
775 }
776