1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/systm.h>
29 #include <sys/stream.h>
30 #include <sys/cmn_err.h>
31 #include <sys/strsubr.h>
32 #include <sys/strsun.h>
33 
34 #include <netinet/in.h>
35 #include <netinet/ip6.h>
36 
37 #include <inet/common.h>
38 #include <inet/ip.h>
39 #include <inet/mib2.h>
40 #include <inet/ipclassifier.h>
41 #include "sctp_impl.h"
42 #include "sctp_asconf.h"
43 
44 /* Timer block states. */
45 typedef enum {
46 	SCTP_TB_RUNNING = 1,
47 	SCTP_TB_IDLE,
48 /* Could not stop/free before mblk got queued */
49 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
50 	SCTP_TB_CANCELLED,
51 	SCTP_TB_TO_BE_FREED
52 } timer_block_state;
53 
54 typedef struct sctp_tb_s {
55 	timer_block_state	sctp_tb_state;
56 	timeout_id_t		sctp_tb_tid;
57 	mblk_t			*sctp_tb_mp;
58 	clock_t			sctp_tb_time_left;
59 } sctp_tb_t;
60 
61 static void sctp_timer_fire(sctp_tb_t *);
62 
63 /*
64  *		sctp_timer mechanism.
65  *
66  * Each timer is represented by a timer mblk. When the
67  * timer fires, and the sctp_t is busy, the timer mblk will be put on
68  * the associated sctp_t timer queue so that it can be executed when
69  * the thread holding the lock on the sctp_t is done with its job.
70  *
71  * Note that there is no lock to protect the timer mblk state.  The reason
72  * is that the timer state can only be changed by a thread holding the
73  * lock on the sctp_t.
74  *
75  * The interface consists of 4 entry points:
76  *	sctp_timer_alloc	- create a timer mblk
77  *	sctp_timer_free		- free a timer mblk
78  *	sctp_timer		- start, restart, stop the timer
79  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
80  *				  the timer did indeed fire.
81  */
82 
83 
84 /*
85  * Start, restart, stop the timer.
86  * If "tim" is -1 the timer is stopped.
87  * Otherwise, the timer is stopped if it is already running, and
88  * set to fire tim clock ticks from now.
89  */
90 void
91 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
92 {
93 	sctp_tb_t *sctp_tb;
94 	int state;
95 
96 	ASSERT(sctp != NULL && mp != NULL);
97 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
98 	ASSERT(mp->b_datap->db_type == M_PCSIG);
99 
100 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
101 	if (tim >= 0) {
102 		state = sctp_tb->sctp_tb_state;
103 		sctp_tb->sctp_tb_time_left = tim;
104 		if (state == SCTP_TB_RUNNING) {
105 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
106 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
107 				/* sctp_timer_valid will start timer */
108 				return;
109 			}
110 		} else if (state != SCTP_TB_IDLE) {
111 			ASSERT(state != SCTP_TB_TO_BE_FREED);
112 			if (state == SCTP_TB_CANCELLED) {
113 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
114 				/* sctp_timer_valid will start timer */
115 				return;
116 			}
117 			if (state == SCTP_TB_RESCHED) {
118 				/* sctp_timer_valid will start timer */
119 				return;
120 			}
121 		} else {
122 			SCTP_REFHOLD(sctp);
123 		}
124 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
125 		sctp_tb->sctp_tb_tid =
126 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
127 		return;
128 	}
129 	switch (tim) {
130 	case -1:
131 		sctp_timer_stop(mp);
132 		break;
133 	default:
134 		ASSERT(0);
135 		break;
136 	}
137 }
138 
139 /*
140  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
141  * sctp timer.
142  *
143  * Allocate an M_PCSIG timer message. The space between db_base and
144  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
145  * space for sctpt_t.
146  */
147 mblk_t *
148 sctp_timer_alloc(sctp_t *sctp, pfv_t func, int sleep)
149 {
150 	mblk_t *mp;
151 	sctp_tb_t *sctp_tb;
152 	sctpt_t	*sctpt;
153 	sctp_stack_t	*sctps = sctp->sctp_sctps;
154 
155 	if (sleep == KM_SLEEP) {
156 		mp = allocb_wait(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI,
157 		    STR_NOSIG, NULL);
158 	} else {
159 		mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI);
160 	}
161 	if (mp != NULL) {
162 		mp->b_datap->db_type = M_PCSIG;
163 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
164 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
165 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
166 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
167 		sctp_tb->sctp_tb_mp = mp;
168 
169 		sctpt = (sctpt_t *)mp->b_rptr;
170 		sctpt->sctpt_sctp = sctp;
171 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
172 		sctpt->sctpt_pfv = func;
173 		return (mp);
174 	}
175 	SCTP_KSTAT(sctps, sctp_add_timer);
176 	return (NULL);
177 }
178 
179 /*
180  * timeout() callback function.
181  * Put the message on the process control block's queue.
182  * If the timer is stopped or freed after
183  * it has fired then sctp_timer() and sctp_timer_valid() will clean
184  * things up.
185  */
186 static void
187 sctp_timer_fire(sctp_tb_t *sctp_tb)
188 {
189 	mblk_t *mp;
190 	sctp_t *sctp;
191 	sctpt_t *sctpt;
192 
193 	mp = sctp_tb->sctp_tb_mp;
194 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
195 	ASSERT(mp->b_datap->db_type == M_PCSIG);
196 
197 	sctpt = (sctpt_t *)mp->b_rptr;
198 	sctp = sctpt->sctpt_sctp;
199 	ASSERT(sctp != NULL);
200 
201 	mutex_enter(&sctp->sctp_lock);
202 	if (sctp->sctp_running) {
203 		/*
204 		 * Put the timer mblk to the special sctp_timer_mp list.
205 		 * This timer will be handled when the thread using this
206 		 * SCTP is done with its job.
207 		 */
208 		if (sctp->sctp_timer_mp == NULL) {
209 			SCTP_REFHOLD(sctp);
210 			sctp->sctp_timer_mp = mp;
211 		} else {
212 			linkb(sctp->sctp_timer_mp, mp);
213 		}
214 		mp->b_cont = NULL;
215 		mutex_exit(&sctp->sctp_lock);
216 	} else {
217 		sctp->sctp_running = B_TRUE;
218 		mutex_exit(&sctp->sctp_lock);
219 
220 		sctp_timer_call(sctp, mp);
221 		WAKE_SCTP(sctp);
222 	}
223 	SCTP_REFRELE(sctp);
224 }
225 
226 /*
227  * Logically free a timer mblk (that might have a pending timeout().)
228  * If the timer has fired and the mblk has been put on the queue then
229  * sctp_timer_valid will free the mblk.
230  */
231 void
232 sctp_timer_free(mblk_t *mp)
233 {
234 	sctp_tb_t *sctp_tb;
235 	int state;
236 	sctpt_t *sctpt;
237 
238 	ASSERT(mp != NULL);
239 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
240 	ASSERT(mp->b_datap->db_type == M_PCSIG);
241 
242 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
243 	state = sctp_tb->sctp_tb_state;
244 
245 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
246 
247 	if (state == SCTP_TB_RUNNING) {
248 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
249 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
250 			/* sctp_timer_valid will free the mblk */
251 			return;
252 		}
253 		sctpt = (sctpt_t *)mp->b_rptr;
254 		SCTP_REFRELE(sctpt->sctpt_sctp);
255 	} else if (state != SCTP_TB_IDLE) {
256 		ASSERT(state != SCTP_TB_TO_BE_FREED);
257 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
258 		/* sctp_timer_valid will free the mblk */
259 		return;
260 	}
261 	freeb(mp);
262 }
263 
264 /*
265  * Called from sctp_timer(,,-1)
266  */
267 void
268 sctp_timer_stop(mblk_t *mp)
269 {
270 	sctp_tb_t *sctp_tb;
271 	int state;
272 	sctpt_t *sctpt;
273 
274 	ASSERT(mp != NULL);
275 	ASSERT(mp->b_datap->db_type == M_PCSIG);
276 
277 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
278 	state = sctp_tb->sctp_tb_state;
279 
280 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
281 
282 	if (state == SCTP_TB_RUNNING) {
283 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
284 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
285 		} else {
286 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
287 			sctpt = (sctpt_t *)mp->b_rptr;
288 			SCTP_REFRELE(sctpt->sctpt_sctp);
289 		}
290 	} else if (state == SCTP_TB_RESCHED) {
291 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
292 	}
293 }
294 
295 /*
296  * The user of the sctp_timer mechanism is required to call
297  * sctp_timer_valid() for each M_PCSIG message processed in the
298  * service procedures.
299  * sctp_timer_valid will return "true" if the timer actually did fire.
300  */
301 
302 static boolean_t
303 sctp_timer_valid(mblk_t *mp)
304 {
305 	sctp_tb_t *sctp_tb;
306 	int state;
307 	sctpt_t *sctpt;
308 
309 	ASSERT(mp != NULL);
310 	ASSERT(mp->b_datap->db_type == M_PCSIG);
311 
312 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
313 	sctpt = (sctpt_t *)mp->b_rptr;
314 	state = sctp_tb->sctp_tb_state;
315 	if (state != SCTP_TB_RUNNING) {
316 		ASSERT(state != SCTP_TB_IDLE);
317 		if (state == SCTP_TB_TO_BE_FREED) {
318 			/*
319 			 * sctp_timer_free was called after the message
320 			 * was putq'ed.
321 			 */
322 			freeb(mp);
323 			return (B_FALSE);
324 		}
325 		if (state == SCTP_TB_CANCELLED) {
326 			/* The timer was stopped after the mblk was putq'ed */
327 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
328 			return (B_FALSE);
329 		}
330 		if (state == SCTP_TB_RESCHED) {
331 			/*
332 			 * The timer was stopped and then restarted after
333 			 * the mblk was putq'ed.
334 			 * sctp_tb_time_left contains the number of ticks that
335 			 * the timer was restarted with.
336 			 * The sctp will not be disapper between the time
337 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
338 			 * we get here as sctp_add_recvq() does a refhold.
339 			 */
340 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
341 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
342 			    sctp_tb, sctp_tb->sctp_tb_time_left);
343 			SCTP_REFHOLD(sctpt->sctpt_sctp);
344 			return (B_FALSE);
345 		}
346 	}
347 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
348 	return (B_TRUE);
349 }
350 
351 /*
352  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
353  * timer was cancelled or not.
354  */
355 void
356 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
357 {
358 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
359 
360 	if (sctp_timer_valid(mp)) {
361 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
362 	}
363 }
364 
365 /*
366  * Delayed ack
367  */
368 void
369 sctp_ack_timer(sctp_t *sctp)
370 {
371 	sctp_stack_t	*sctps = sctp->sctp_sctps;
372 
373 	sctp->sctp_ack_timer_running = 0;
374 	sctp->sctp_sack_toggle = sctps->sctps_deferred_acks_max;
375 	BUMP_MIB(&sctps->sctps_mib, sctpOutAckDelayed);
376 	(void) sctp_sack(sctp, NULL);
377 }
378 
379 /*
380  * Peer address heartbeat timer handler
381  */
382 void
383 sctp_heartbeat_timer(sctp_t *sctp)
384 {
385 	sctp_faddr_t	*fp;
386 	int64_t		now;
387 	int64_t		earliest_expiry;
388 	int		cnt;
389 	sctp_stack_t	*sctps = sctp->sctp_sctps;
390 
391 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
392 		/*
393 		 * If there is a peer address with no strikes,
394 		 * don't give up yet. If enough other peer
395 		 * address are down, we could otherwise fail
396 		 * the association prematurely.  This is a
397 		 * byproduct of our aggressive probe approach
398 		 * when a heartbeat fails to connect. We may
399 		 * wish to revisit this...
400 		 */
401 		if (!sctp_is_a_faddr_clean(sctp)) {
402 			/* time to give up */
403 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
404 			BUMP_MIB(&sctps->sctps_mib, sctpTimHeartBeatDrop);
405 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
406 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
407 			    sctp->sctp_client_errno : ETIMEDOUT);
408 			return;
409 		}
410 	}
411 
412 	/* Only send heartbeats in the established state */
413 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
414 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
415 		return;
416 	}
417 
418 	now = ddi_get_lbolt64();
419 	earliest_expiry = 0;
420 	cnt = sctps->sctps_maxburst;
421 
422 	/*
423 	 * Walk through all faddrs.  Since the timer should run infrequently
424 	 * and the number of peer addresses should not be big, this should
425 	 * be OK.
426 	 */
427 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
428 		/*
429 		 * If the peer is unreachable because there is no available
430 		 * source address, call sctp_get_dest() to see if it is
431 		 * reachable now.  If it is OK, the state will become
432 		 * unconfirmed.  And the following code to handle unconfirmed
433 		 * address will be executed.  If it is still not OK,
434 		 * re-schedule.  If heartbeat is enabled, only try this
435 		 * up to the normal heartbeat max times.  But if heartbeat
436 		 * is disable, this retry may go on forever.
437 		 */
438 		if (fp->state == SCTP_FADDRS_UNREACH) {
439 			sctp_get_dest(sctp, fp);
440 			if (fp->state == SCTP_FADDRS_UNREACH) {
441 				if (fp->hb_enabled &&
442 				    ++fp->strikes > fp->max_retr &&
443 				    sctp_faddr_dead(sctp, fp,
444 				    SCTP_FADDRS_DOWN) == -1) {
445 					/* Assoc is dead */
446 					return;
447 				}
448 				fp->hb_expiry = now + SET_HB_INTVL(fp);
449 				goto set_expiry;
450 			} else {
451 				/* Send a heartbeat immediately. */
452 				fp->hb_expiry = now;
453 			}
454 		}
455 		/*
456 		 * Don't send heartbeat to this address if it is not
457 		 * hb_enabled and the address has been confirmed.
458 		 */
459 		if (!fp->hb_enabled && fp->state != SCTP_FADDRS_UNCONFIRMED) {
460 			continue;
461 		}
462 
463 		/*
464 		 * The heartbeat timer is expired.  If the address is dead,
465 		 * we still send heartbeat to it in case it becomes alive
466 		 * again.  But we will only send once in a while, calculated
467 		 * by SET_HB_INTVL().
468 		 *
469 		 * If the address is alive and there is a hearbeat pending,
470 		 * resend the heartbeat and start exponential backoff on the
471 		 * heartbeat timeout value.  If there is no heartbeat pending,
472 		 * just send out one.
473 		 */
474 		if (now >= fp->hb_expiry) {
475 			if (fp->hb_pending) {
476 				/*
477 				 * If an address is not confirmed, no need
478 				 * to bump the overall counter as it doesn't
479 				 * matter as we will not use it to send data
480 				 * and it should not affect the association.
481 				 */
482 				switch (fp->state) {
483 				case SCTP_FADDRS_ALIVE:
484 					sctp->sctp_strikes++;
485 					/* FALLTHRU */
486 				case SCTP_FADDRS_UNCONFIRMED:
487 					/*
488 					 * Retransmission implies that RTO
489 					 * is probably not correct.
490 					 */
491 					fp->rtt_updates = 0;
492 					fp->strikes++;
493 					if (fp->strikes > fp->max_retr) {
494 						if (sctp_faddr_dead(sctp, fp,
495 						    SCTP_FADDRS_DOWN) == -1) {
496 							/* Assoc is dead */
497 							return;
498 						}
499 						/*
500 						 * Addr is down; keep initial
501 						 * RTO
502 						 */
503 						fp->rto =
504 						    sctp->sctp_rto_initial;
505 						goto dead_addr;
506 					} else {
507 						SCTP_CALC_RXT(sctp, fp);
508 						fp->hb_expiry = now + fp->rto;
509 					}
510 					break;
511 				case SCTP_FADDRS_DOWN:
512 dead_addr:
513 					fp->hb_expiry = now + SET_HB_INTVL(fp);
514 					break;
515 				default:
516 					continue;
517 				}
518 			} else {
519 				/*
520 				 * If there is unack'ed data, no need to
521 				 * send a heart beat.
522 				 */
523 				if (fp->suna > 0) {
524 					fp->hb_expiry = now + SET_HB_INTVL(fp);
525 					goto set_expiry;
526 				} else {
527 					fp->hb_expiry = now + fp->rto;
528 				}
529 			}
530 			/*
531 			 * Note that the total number of heartbeat we can send
532 			 * out simultaneously is limited by sctp_maxburst.  If
533 			 * the limit is exceeded, we need to wait for the next
534 			 * timeout to send them.  This should only happen if
535 			 * there is unconfirmed address.  Note that hb_pending
536 			 * is set in sctp_send_heartbeat().  So if a heartbeat
537 			 * is not sent, it will not affect the state of the
538 			 * peer address.
539 			 */
540 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
541 				sctp_send_heartbeat(sctp, fp);
542 		}
543 set_expiry:
544 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
545 			earliest_expiry = fp->hb_expiry;
546 	}
547 	if (sctp->sctp_autoclose != 0) {
548 		int64_t expire;
549 
550 		expire = sctp->sctp_active + sctp->sctp_autoclose;
551 
552 		if (expire <= now) {
553 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
554 			sctp_send_shutdown(sctp, 0);
555 			return;
556 		}
557 		if (expire < earliest_expiry || earliest_expiry == 0)
558 			earliest_expiry = expire;
559 	}
560 
561 	earliest_expiry -= now;
562 	if (earliest_expiry < 0)
563 		earliest_expiry = 1;
564 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
565 }
566 
567 void
568 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
569 {
570 	mblk_t 		*mp;
571 	sctp_stack_t	*sctps = sctp->sctp_sctps;
572 
573 	ASSERT(fp != NULL);
574 
575 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
576 	    SCTP_PRINTADDR(fp->faddr)));
577 
578 	fp->timer_running = 0;
579 
580 	/* Check is we've reached the max for retries */
581 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
582 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
583 			/* time to give up */
584 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
585 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
586 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
587 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
588 			    sctp->sctp_client_errno : ETIMEDOUT);
589 			return;
590 		}
591 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
592 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
593 			/* time to give up */
594 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
595 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
596 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
597 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
598 			    sctp->sctp_client_errno : ETIMEDOUT);
599 			return;
600 		}
601 	}
602 
603 	if (fp->strikes >= fp->max_retr) {
604 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
605 			return;
606 		}
607 	}
608 
609 	switch (sctp->sctp_state) {
610 	case SCTPS_SHUTDOWN_RECEIVED:
611 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
612 		    NULL);
613 
614 		/* FALLTHRU */
615 	case SCTPS_ESTABLISHED:
616 	case SCTPS_SHUTDOWN_PENDING:
617 		if (sctp->sctp_xmit_head == NULL &&
618 		    sctp->sctp_xmit_unsent == NULL) {
619 			/* Nothing to retransmit */
620 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
621 				sctp_send_shutdown(sctp, 1);
622 			}
623 			return;
624 		}
625 
626 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
627 
628 		sctp_rexmit(sctp, fp);
629 		/*
630 		 * sctp_rexmit() will increase the strikes and restart the
631 		 * timer, so return here.
632 		 */
633 		return;
634 	case SCTPS_COOKIE_WAIT:
635 		BUMP_LOCAL(sctp->sctp_T1expire);
636 rxmit_init:
637 		/* retransmit init */
638 		/*
639 		 * We don't take the conn hash lock here since the source
640 		 * address list won't be modified (it would have been done
641 		 * the first time around).
642 		 */
643 		mp = sctp_init_mp(sctp, fp);
644 		if (mp != NULL) {
645 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
646 			(void) conn_ip_output(mp, fp->ixa);
647 			BUMP_LOCAL(sctp->sctp_opkts);
648 		}
649 		break;
650 	case SCTPS_COOKIE_ECHOED:
651 		BUMP_LOCAL(sctp->sctp_T1expire);
652 		if (sctp->sctp_cookie_mp == NULL) {
653 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
654 			goto rxmit_init;
655 		}
656 		mp = dupmsg(sctp->sctp_cookie_mp);
657 		if (mp == NULL)
658 			break;
659 		(void) conn_ip_output(mp, fp->ixa);
660 		BUMP_LOCAL(sctp->sctp_opkts);
661 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
662 		break;
663 	case SCTPS_SHUTDOWN_SENT:
664 		BUMP_LOCAL(sctp->sctp_T2expire);
665 		sctp_send_shutdown(sctp, 1);
666 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
667 		break;
668 	case SCTPS_SHUTDOWN_ACK_SENT:
669 		/* We shouldn't have any more outstanding data */
670 		ASSERT(sctp->sctp_xmit_head == NULL);
671 		ASSERT(sctp->sctp_xmit_unsent == NULL);
672 
673 		BUMP_LOCAL(sctp->sctp_T2expire);
674 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
675 		    NULL);
676 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
677 		break;
678 	default:
679 		ASSERT(0);
680 		break;
681 	}
682 
683 	fp->strikes++;
684 	sctp->sctp_strikes++;
685 	SCTP_CALC_RXT(sctp, fp);
686 
687 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
688 }
689 
690 /*
691  * RTO calculation. timesent and now are both in ms.
692  */
693 void
694 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
695 {
696 	int rtt;
697 
698 	/* Calculate the RTT in ms */
699 	rtt = (int)delta;
700 	rtt = rtt > 0 ? rtt : 1;
701 
702 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
703 
704 	/* Is this the first RTT measurement? */
705 	if (fp->srtt == -1) {
706 		fp->srtt = rtt;
707 		fp->rttvar = rtt / 2;
708 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
709 	} else {
710 		int abs;
711 		/*
712 		 * Versions of the RTO equations that use fixed-point math.
713 		 * alpha and beta are NOT tunable in this implementation,
714 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
715 		 */
716 		abs = fp->srtt - rtt;
717 		abs = abs >= 0 ? abs : -abs;
718 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
719 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
720 
721 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
722 		fp->rto = fp->srtt + 4 * fp->rttvar;
723 	}
724 
725 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
726 	    fp->srtt, fp->rttvar, fp->rto));
727 
728 	/* Bound the RTO by configured min and max values */
729 	if (fp->rto < sctp->sctp_rto_min) {
730 		fp->rto = sctp->sctp_rto_min;
731 	}
732 	if (fp->rto > sctp->sctp_rto_max) {
733 		fp->rto = sctp->sctp_rto_max;
734 	}
735 
736 	SCTP_MAX_RTO(sctp, fp);
737 	fp->rtt_updates++;
738 }
739 
740 void
741 sctp_free_faddr_timers(sctp_t *sctp)
742 {
743 	sctp_faddr_t *fp;
744 
745 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
746 		if (fp->timer_mp != NULL) {
747 			sctp_timer_free(fp->timer_mp);
748 			fp->timer_mp = NULL;
749 			fp->timer_running = 0;
750 		}
751 		if (fp->rc_timer_mp != NULL) {
752 			sctp_timer_free(fp->rc_timer_mp);
753 			fp->rc_timer_mp = NULL;
754 			fp->rc_timer_running = 0;
755 		}
756 	}
757 }
758 
759 void
760 sctp_stop_faddr_timers(sctp_t *sctp)
761 {
762 	sctp_faddr_t *fp;
763 
764 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
765 		SCTP_FADDR_TIMER_STOP(fp);
766 		SCTP_FADDR_RC_TIMER_STOP(fp);
767 	}
768 }
769 
770 void
771 sctp_process_timer(sctp_t *sctp)
772 {
773 	mblk_t *mp;
774 
775 	ASSERT(sctp->sctp_running);
776 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
777 	while ((mp = sctp->sctp_timer_mp) != NULL) {
778 		ASSERT(DB_TYPE(mp) == M_PCSIG);
779 		/*
780 		 * Since the timer mblk can be freed in sctp_timer_call(),
781 		 * we need to grab the b_cont before that.
782 		 */
783 		sctp->sctp_timer_mp = mp->b_cont;
784 		mp->b_cont = NULL;
785 		/*
786 		 * We have a reference on the sctp, the lock must be
787 		 * dropped to avoid deadlocks with functions potentially
788 		 * called in this context which in turn call untimeout().
789 		 */
790 		mutex_exit(&sctp->sctp_lock);
791 		sctp_timer_call(sctp, mp);
792 		mutex_enter(&sctp->sctp_lock);
793 	}
794 	SCTP_REFRELE(sctp);
795 }
796