1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 
28 #include <sys/types.h>
29 #include <sys/systm.h>
30 #include <sys/stream.h>
31 #include <sys/cmn_err.h>
32 #include <sys/strsubr.h>
33 #include <sys/strsun.h>
34 
35 #include <netinet/in.h>
36 #include <netinet/ip6.h>
37 
38 #include <inet/common.h>
39 #include <inet/ip.h>
40 #include <inet/mib2.h>
41 #include <inet/ipclassifier.h>
42 #include "sctp_impl.h"
43 #include "sctp_asconf.h"
44 
45 /* Timer block states. */
46 typedef enum {
47 	SCTP_TB_RUNNING = 1,
48 	SCTP_TB_IDLE,
49 /* Could not stop/free before mblk got queued */
50 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
51 	SCTP_TB_CANCELLED,
52 	SCTP_TB_TO_BE_FREED
53 } timer_block_state;
54 
55 typedef struct sctp_tb_s {
56 	timer_block_state	sctp_tb_state;
57 	timeout_id_t		sctp_tb_tid;
58 	mblk_t			*sctp_tb_mp;
59 	clock_t			sctp_tb_time_left;
60 } sctp_tb_t;
61 
62 static void sctp_timer_fire(sctp_tb_t *);
63 
64 /*
65  *		sctp_timer mechanism.
66  *
67  * Each timer is represented by a timer mblk. When the
68  * timer fires, and the sctp_t is busy, the timer mblk will be put on
69  * the associated sctp_t timer queue so that it can be executed when
70  * the thread holding the lock on the sctp_t is done with its job.
71  *
72  * Note that there is no lock to protect the timer mblk state.  The reason
73  * is that the timer state can only be changed by a thread holding the
74  * lock on the sctp_t.
75  *
76  * The interface consists of 4 entry points:
77  *	sctp_timer_alloc	- create a timer mblk
78  *	sctp_timer_free		- free a timer mblk
79  *	sctp_timer		- start, restart, stop the timer
80  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
81  *				  the timer did indeed fire.
82  */
83 
84 
85 /*
86  * Start, restart, stop the timer.
87  * If "tim" is -1 the timer is stopped.
88  * Otherwise, the timer is stopped if it is already running, and
89  * set to fire tim clock ticks from now.
90  */
91 void
92 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
93 {
94 	sctp_tb_t *sctp_tb;
95 	int state;
96 
97 	ASSERT(sctp != NULL && mp != NULL);
98 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
99 	ASSERT(mp->b_datap->db_type == M_PCSIG);
100 
101 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
102 	if (tim >= 0) {
103 		state = sctp_tb->sctp_tb_state;
104 		sctp_tb->sctp_tb_time_left = tim;
105 		if (state == SCTP_TB_RUNNING) {
106 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
107 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
108 				/* sctp_timer_valid will start timer */
109 				return;
110 			}
111 		} else if (state != SCTP_TB_IDLE) {
112 			ASSERT(state != SCTP_TB_TO_BE_FREED);
113 			if (state == SCTP_TB_CANCELLED) {
114 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
115 				/* sctp_timer_valid will start timer */
116 				return;
117 			}
118 			if (state == SCTP_TB_RESCHED) {
119 				/* sctp_timer_valid will start timer */
120 				return;
121 			}
122 		} else {
123 			SCTP_REFHOLD(sctp);
124 		}
125 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
126 		sctp_tb->sctp_tb_tid =
127 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
128 		return;
129 	}
130 	switch (tim) {
131 	case -1:
132 		sctp_timer_stop(mp);
133 		break;
134 	default:
135 		ASSERT(0);
136 		break;
137 	}
138 }
139 
140 /*
141  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
142  * sctp timer.
143  *
144  * Allocate an M_PCSIG timer message. The space between db_base and
145  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
146  * space for sctpt_t.
147  */
148 mblk_t *
149 sctp_timer_alloc(sctp_t *sctp, pfv_t func, int sleep)
150 {
151 	mblk_t *mp;
152 	sctp_tb_t *sctp_tb;
153 	sctpt_t	*sctpt;
154 	sctp_stack_t	*sctps = sctp->sctp_sctps;
155 
156 	if (sleep == KM_SLEEP) {
157 		mp = allocb_wait(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI,
158 		    STR_NOSIG, NULL);
159 	} else {
160 		mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI);
161 	}
162 	if (mp != NULL) {
163 		mp->b_datap->db_type = M_PCSIG;
164 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
165 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
166 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
167 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
168 		sctp_tb->sctp_tb_mp = mp;
169 
170 		sctpt = (sctpt_t *)mp->b_rptr;
171 		sctpt->sctpt_sctp = sctp;
172 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
173 		sctpt->sctpt_pfv = func;
174 		return (mp);
175 	}
176 	SCTP_KSTAT(sctps, sctp_add_timer);
177 	return (NULL);
178 }
179 
180 /*
181  * timeout() callback function.
182  * Put the message on the process control block's queue.
183  * If the timer is stopped or freed after
184  * it has fired then sctp_timer() and sctp_timer_valid() will clean
185  * things up.
186  */
187 static void
188 sctp_timer_fire(sctp_tb_t *sctp_tb)
189 {
190 	mblk_t *mp;
191 	sctp_t *sctp;
192 	sctpt_t *sctpt;
193 
194 	mp = sctp_tb->sctp_tb_mp;
195 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
196 	ASSERT(mp->b_datap->db_type == M_PCSIG);
197 
198 	sctpt = (sctpt_t *)mp->b_rptr;
199 	sctp = sctpt->sctpt_sctp;
200 	ASSERT(sctp != NULL);
201 
202 	mutex_enter(&sctp->sctp_lock);
203 	if (sctp->sctp_running) {
204 		/*
205 		 * Put the timer mblk to the special sctp_timer_mp list.
206 		 * This timer will be handled when the thread using this
207 		 * SCTP is done with its job.
208 		 */
209 		if (sctp->sctp_timer_mp == NULL) {
210 			SCTP_REFHOLD(sctp);
211 			sctp->sctp_timer_mp = mp;
212 		} else {
213 			linkb(sctp->sctp_timer_mp, mp);
214 		}
215 		mp->b_cont = NULL;
216 		mutex_exit(&sctp->sctp_lock);
217 	} else {
218 		sctp->sctp_running = B_TRUE;
219 		mutex_exit(&sctp->sctp_lock);
220 
221 		sctp_timer_call(sctp, mp);
222 		WAKE_SCTP(sctp);
223 		sctp_process_sendq(sctp);
224 	}
225 	SCTP_REFRELE(sctp);
226 }
227 
228 /*
229  * Logically free a timer mblk (that might have a pending timeout().)
230  * If the timer has fired and the mblk has been put on the queue then
231  * sctp_timer_valid will free the mblk.
232  */
233 void
234 sctp_timer_free(mblk_t *mp)
235 {
236 	sctp_tb_t *sctp_tb;
237 	int state;
238 	sctpt_t *sctpt;
239 
240 	ASSERT(mp != NULL);
241 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
242 	ASSERT(mp->b_datap->db_type == M_PCSIG);
243 
244 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
245 	state = sctp_tb->sctp_tb_state;
246 
247 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
248 
249 	if (state == SCTP_TB_RUNNING) {
250 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
251 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
252 			/* sctp_timer_valid will free the mblk */
253 			return;
254 		}
255 		sctpt = (sctpt_t *)mp->b_rptr;
256 		SCTP_REFRELE(sctpt->sctpt_sctp);
257 	} else if (state != SCTP_TB_IDLE) {
258 		ASSERT(state != SCTP_TB_TO_BE_FREED);
259 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
260 		/* sctp_timer_valid will free the mblk */
261 		return;
262 	}
263 	freeb(mp);
264 }
265 
266 /*
267  * Called from sctp_timer(,,-1)
268  */
269 void
270 sctp_timer_stop(mblk_t *mp)
271 {
272 	sctp_tb_t *sctp_tb;
273 	int state;
274 	sctpt_t *sctpt;
275 
276 	ASSERT(mp != NULL);
277 	ASSERT(mp->b_datap->db_type == M_PCSIG);
278 
279 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
280 	state = sctp_tb->sctp_tb_state;
281 
282 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
283 
284 	if (state == SCTP_TB_RUNNING) {
285 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
286 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
287 		} else {
288 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
289 			sctpt = (sctpt_t *)mp->b_rptr;
290 			SCTP_REFRELE(sctpt->sctpt_sctp);
291 		}
292 	} else if (state == SCTP_TB_RESCHED) {
293 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
294 	}
295 }
296 
297 /*
298  * The user of the sctp_timer mechanism is required to call
299  * sctp_timer_valid() for each M_PCSIG message processed in the
300  * service procedures.
301  * sctp_timer_valid will return "true" if the timer actually did fire.
302  */
303 
304 static boolean_t
305 sctp_timer_valid(mblk_t *mp)
306 {
307 	sctp_tb_t *sctp_tb;
308 	int state;
309 	sctpt_t *sctpt;
310 
311 	ASSERT(mp != NULL);
312 	ASSERT(mp->b_datap->db_type == M_PCSIG);
313 
314 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
315 	sctpt = (sctpt_t *)mp->b_rptr;
316 	state = sctp_tb->sctp_tb_state;
317 	if (state != SCTP_TB_RUNNING) {
318 		ASSERT(state != SCTP_TB_IDLE);
319 		if (state == SCTP_TB_TO_BE_FREED) {
320 			/*
321 			 * sctp_timer_free was called after the message
322 			 * was putq'ed.
323 			 */
324 			freeb(mp);
325 			return (B_FALSE);
326 		}
327 		if (state == SCTP_TB_CANCELLED) {
328 			/* The timer was stopped after the mblk was putq'ed */
329 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
330 			return (B_FALSE);
331 		}
332 		if (state == SCTP_TB_RESCHED) {
333 			/*
334 			 * The timer was stopped and then restarted after
335 			 * the mblk was putq'ed.
336 			 * sctp_tb_time_left contains the number of ticks that
337 			 * the timer was restarted with.
338 			 * The sctp will not be disapper between the time
339 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
340 			 * we get here as sctp_add_recvq() does a refhold.
341 			 */
342 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
343 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
344 			    sctp_tb, sctp_tb->sctp_tb_time_left);
345 			SCTP_REFHOLD(sctpt->sctpt_sctp);
346 			return (B_FALSE);
347 		}
348 	}
349 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
350 	return (B_TRUE);
351 }
352 
353 /*
354  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
355  * timer was cancelled or not.
356  */
357 void
358 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
359 {
360 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
361 
362 	if (sctp_timer_valid(mp)) {
363 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
364 	}
365 }
366 
367 /*
368  * Delayed ack
369  */
370 void
371 sctp_ack_timer(sctp_t *sctp)
372 {
373 	sctp_stack_t	*sctps = sctp->sctp_sctps;
374 
375 	sctp->sctp_ack_timer_running = 0;
376 	sctp->sctp_sack_toggle = sctps->sctps_deferred_acks_max;
377 	BUMP_MIB(&sctps->sctps_mib, sctpOutAckDelayed);
378 	(void) sctp_sack(sctp, NULL);
379 }
380 
381 /*
382  * Peer address heartbeat timer handler
383  */
384 void
385 sctp_heartbeat_timer(sctp_t *sctp)
386 {
387 	sctp_faddr_t	*fp;
388 	int64_t		now;
389 	int64_t		earliest_expiry;
390 	int		cnt;
391 	sctp_stack_t	*sctps = sctp->sctp_sctps;
392 
393 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
394 		/*
395 		 * If there is a peer address with no strikes,
396 		 * don't give up yet. If enough other peer
397 		 * address are down, we could otherwise fail
398 		 * the association prematurely.  This is a
399 		 * byproduct of our aggressive probe approach
400 		 * when a heartbeat fails to connect. We may
401 		 * wish to revisit this...
402 		 */
403 		if (!sctp_is_a_faddr_clean(sctp)) {
404 			/* time to give up */
405 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
406 			BUMP_MIB(&sctps->sctps_mib, sctpTimHeartBeatDrop);
407 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
408 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
409 			    sctp->sctp_client_errno : ETIMEDOUT);
410 			return;
411 		}
412 	}
413 
414 	/* Only send heartbeats in the established state */
415 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
416 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
417 		return;
418 	}
419 
420 	now = lbolt64;
421 	earliest_expiry = 0;
422 	cnt = sctps->sctps_maxburst;
423 
424 	/*
425 	 * Walk through all faddrs.  Since the timer should run infrequently
426 	 * and the number of peer addresses should not be big, this should
427 	 * be OK.
428 	 */
429 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
430 		/*
431 		 * If the peer is unreachable because there is no available
432 		 * source address, call sctp_get_ire() to see if it is
433 		 * reachable now.  If it is OK, the state will become
434 		 * unconfirmed.  And the following code to handle unconfirmed
435 		 * address will be executed.  If it is still not OK,
436 		 * re-schedule.  If heartbeat is enabled, only try this
437 		 * up to the normal heartbeat max times.  But if heartbeat
438 		 * is disable, this retry may go on forever.
439 		 */
440 		if (fp->state == SCTP_FADDRS_UNREACH) {
441 			sctp_get_ire(sctp, fp);
442 			if (fp->state == SCTP_FADDRS_UNREACH) {
443 				if (fp->hb_enabled &&
444 				    ++fp->strikes > fp->max_retr &&
445 				    sctp_faddr_dead(sctp, fp,
446 				    SCTP_FADDRS_DOWN) == -1) {
447 					/* Assoc is dead */
448 					return;
449 				}
450 				fp->hb_expiry = now + SET_HB_INTVL(fp);
451 				goto set_expiry;
452 			} else {
453 				/* Send a heartbeat immediately. */
454 				fp->hb_expiry = now;
455 			}
456 		}
457 		/*
458 		 * Don't send heartbeat to this address if it is not
459 		 * hb_enabled and the address has been confirmed.
460 		 */
461 		if (!fp->hb_enabled && fp->state != SCTP_FADDRS_UNCONFIRMED) {
462 			continue;
463 		}
464 
465 		/*
466 		 * The heartbeat timer is expired.  If the address is dead,
467 		 * we still send heartbeat to it in case it becomes alive
468 		 * again.  But we will only send once in a while, calculated
469 		 * by SET_HB_INTVL().
470 		 *
471 		 * If the address is alive and there is a hearbeat pending,
472 		 * resend the heartbeat and start exponential backoff on the
473 		 * heartbeat timeout value.  If there is no heartbeat pending,
474 		 * just send out one.
475 		 */
476 		if (now >= fp->hb_expiry) {
477 			if (fp->hb_pending) {
478 				/*
479 				 * If an address is not confirmed, no need
480 				 * to bump the overall counter as it doesn't
481 				 * matter as we will not use it to send data
482 				 * and it should not affect the association.
483 				 */
484 				switch (fp->state) {
485 				case SCTP_FADDRS_ALIVE:
486 					sctp->sctp_strikes++;
487 					/* FALLTHRU */
488 				case SCTP_FADDRS_UNCONFIRMED:
489 					/*
490 					 * Retransmission implies that RTO
491 					 * is probably not correct.
492 					 */
493 					fp->rtt_updates = 0;
494 					fp->strikes++;
495 					if (fp->strikes > fp->max_retr) {
496 						if (sctp_faddr_dead(sctp, fp,
497 						    SCTP_FADDRS_DOWN) == -1) {
498 							/* Assoc is dead */
499 							return;
500 						}
501 						/*
502 						 * Addr is down; keep initial
503 						 * RTO
504 						 */
505 						fp->rto =
506 						    sctp->sctp_rto_initial;
507 						goto dead_addr;
508 					} else {
509 						SCTP_CALC_RXT(sctp, fp);
510 						fp->hb_expiry = now + fp->rto;
511 					}
512 					break;
513 				case SCTP_FADDRS_DOWN:
514 dead_addr:
515 					fp->hb_expiry = now + SET_HB_INTVL(fp);
516 					break;
517 				default:
518 					continue;
519 				}
520 			} else {
521 				/*
522 				 * If there is unack'ed data, no need to
523 				 * send a heart beat.
524 				 */
525 				if (fp->suna > 0) {
526 					fp->hb_expiry = now + SET_HB_INTVL(fp);
527 					goto set_expiry;
528 				} else {
529 					fp->hb_expiry = now + fp->rto;
530 				}
531 			}
532 			/*
533 			 * Note that the total number of heartbeat we can send
534 			 * out simultaneously is limited by sctp_maxburst.  If
535 			 * the limit is exceeded, we need to wait for the next
536 			 * timeout to send them.  This should only happen if
537 			 * there is unconfirmed address.  Note that hb_pending
538 			 * is set in sctp_send_heartbeat().  So if a heartbeat
539 			 * is not sent, it will not affect the state of the
540 			 * peer address.
541 			 */
542 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
543 				sctp_send_heartbeat(sctp, fp);
544 		}
545 set_expiry:
546 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
547 			earliest_expiry = fp->hb_expiry;
548 	}
549 	if (sctp->sctp_autoclose != 0) {
550 		int64_t expire;
551 
552 		expire = sctp->sctp_active + sctp->sctp_autoclose;
553 
554 		if (expire <= now) {
555 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
556 			sctp_send_shutdown(sctp, 0);
557 			return;
558 		}
559 		if (expire < earliest_expiry || earliest_expiry == 0)
560 			earliest_expiry = expire;
561 	}
562 
563 	earliest_expiry -= now;
564 	if (earliest_expiry < 0)
565 		earliest_expiry = 1;
566 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
567 }
568 
569 void
570 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
571 {
572 	mblk_t 		*mp;
573 	sctp_stack_t	*sctps = sctp->sctp_sctps;
574 
575 	ASSERT(fp != NULL);
576 
577 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
578 	    SCTP_PRINTADDR(fp->faddr)));
579 
580 	fp->timer_running = 0;
581 
582 	/* Check is we've reached the max for retries */
583 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
584 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
585 			/* time to give up */
586 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
587 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
588 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
589 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
590 			    sctp->sctp_client_errno : ETIMEDOUT);
591 			return;
592 		}
593 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
594 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
595 			/* time to give up */
596 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
597 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
598 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
599 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
600 			    sctp->sctp_client_errno : ETIMEDOUT);
601 			return;
602 		}
603 	}
604 
605 	if (fp->strikes >= fp->max_retr) {
606 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
607 			return;
608 		}
609 	}
610 
611 	switch (sctp->sctp_state) {
612 	case SCTPS_SHUTDOWN_RECEIVED:
613 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
614 		    NULL);
615 
616 		/* FALLTHRU */
617 	case SCTPS_ESTABLISHED:
618 	case SCTPS_SHUTDOWN_PENDING:
619 		if (sctp->sctp_xmit_head == NULL &&
620 		    sctp->sctp_xmit_unsent == NULL) {
621 			/* Nothing to retransmit */
622 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
623 				sctp_send_shutdown(sctp, 1);
624 			}
625 			return;
626 		}
627 
628 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
629 
630 		sctp_rexmit(sctp, fp);
631 		/*
632 		 * sctp_rexmit() will increase the strikes and restart the
633 		 * timer, so return here.
634 		 */
635 		return;
636 	case SCTPS_COOKIE_WAIT:
637 		BUMP_LOCAL(sctp->sctp_T1expire);
638 rxmit_init:
639 		/* retransmit init */
640 		/*
641 		 * We don't take the conn hash lock here since the source
642 		 * address list won't be modified (it would have been done
643 		 * the first time around).
644 		 */
645 		mp = sctp_init_mp(sctp);
646 		if (mp != NULL) {
647 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
648 			sctp_add_sendq(sctp, mp);
649 		}
650 		break;
651 	case SCTPS_COOKIE_ECHOED: {
652 		ipha_t *iph;
653 
654 		BUMP_LOCAL(sctp->sctp_T1expire);
655 		if (sctp->sctp_cookie_mp == NULL) {
656 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
657 			goto rxmit_init;
658 		}
659 		mp = dupmsg(sctp->sctp_cookie_mp);
660 		if (mp == NULL)
661 			break;
662 		iph = (ipha_t *)mp->b_rptr;
663 		/* Reset the IP ident. */
664 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
665 			iph->ipha_ident = 0;
666 		sctp_add_sendq(sctp, mp);
667 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
668 		break;
669 	}
670 	case SCTPS_SHUTDOWN_SENT:
671 		BUMP_LOCAL(sctp->sctp_T2expire);
672 		sctp_send_shutdown(sctp, 1);
673 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
674 		break;
675 	case SCTPS_SHUTDOWN_ACK_SENT:
676 		/* We shouldn't have any more outstanding data */
677 		ASSERT(sctp->sctp_xmit_head == NULL);
678 		ASSERT(sctp->sctp_xmit_unsent == NULL);
679 
680 		BUMP_LOCAL(sctp->sctp_T2expire);
681 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
682 		    NULL);
683 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
684 		break;
685 	default:
686 		ASSERT(0);
687 		break;
688 	}
689 
690 	fp->strikes++;
691 	sctp->sctp_strikes++;
692 	SCTP_CALC_RXT(sctp, fp);
693 
694 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
695 }
696 
697 /*
698  * RTO calculation. timesent and now are both in ms.
699  */
700 void
701 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
702 {
703 	int rtt;
704 
705 	/* Calculate the RTT in ms */
706 	rtt = (int)delta;
707 	rtt = rtt > 0 ? rtt : 1;
708 
709 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
710 
711 	/* Is this the first RTT measurement? */
712 	if (fp->srtt == -1) {
713 		fp->srtt = rtt;
714 		fp->rttvar = rtt / 2;
715 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
716 	} else {
717 		int abs;
718 		/*
719 		 * Versions of the RTO equations that use fixed-point math.
720 		 * alpha and beta are NOT tunable in this implementation,
721 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
722 		 */
723 		abs = fp->srtt - rtt;
724 		abs = abs >= 0 ? abs : -abs;
725 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
726 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
727 
728 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
729 		fp->rto = fp->srtt + 4 * fp->rttvar;
730 	}
731 
732 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
733 	    fp->srtt, fp->rttvar, fp->rto));
734 
735 	/* Bound the RTO by configured min and max values */
736 	if (fp->rto < sctp->sctp_rto_min) {
737 		fp->rto = sctp->sctp_rto_min;
738 	}
739 	if (fp->rto > sctp->sctp_rto_max) {
740 		fp->rto = sctp->sctp_rto_max;
741 	}
742 
743 	SCTP_MAX_RTO(sctp, fp);
744 	fp->rtt_updates++;
745 }
746 
747 void
748 sctp_free_faddr_timers(sctp_t *sctp)
749 {
750 	sctp_faddr_t *fp;
751 
752 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
753 		if (fp->timer_mp != NULL) {
754 			sctp_timer_free(fp->timer_mp);
755 			fp->timer_mp = NULL;
756 			fp->timer_running = 0;
757 		}
758 		if (fp->rc_timer_mp != NULL) {
759 			sctp_timer_free(fp->rc_timer_mp);
760 			fp->rc_timer_mp = NULL;
761 			fp->rc_timer_running = 0;
762 		}
763 	}
764 }
765 
766 void
767 sctp_stop_faddr_timers(sctp_t *sctp)
768 {
769 	sctp_faddr_t *fp;
770 
771 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
772 		SCTP_FADDR_TIMER_STOP(fp);
773 		SCTP_FADDR_RC_TIMER_STOP(fp);
774 	}
775 }
776 
777 void
778 sctp_process_timer(sctp_t *sctp)
779 {
780 	mblk_t *mp;
781 
782 	ASSERT(sctp->sctp_running);
783 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
784 	while ((mp = sctp->sctp_timer_mp) != NULL) {
785 		ASSERT(DB_TYPE(mp) == M_PCSIG);
786 		/*
787 		 * Since the timer mblk can be freed in sctp_timer_call(),
788 		 * we need to grab the b_cont before that.
789 		 */
790 		sctp->sctp_timer_mp = mp->b_cont;
791 		mp->b_cont = NULL;
792 		/*
793 		 * We have a reference on the sctp, the lock must be
794 		 * dropped to avoid deadlocks with functions potentially
795 		 * called in this context which in turn call untimeout().
796 		 */
797 		mutex_exit(&sctp->sctp_lock);
798 		sctp_timer_call(sctp, mp);
799 		mutex_enter(&sctp->sctp_lock);
800 	}
801 	SCTP_REFRELE(sctp);
802 }
803