1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/stream.h>
32 #include <sys/cmn_err.h>
33 #include <sys/strsubr.h>
34 #include <sys/strsun.h>
35 
36 #include <netinet/in.h>
37 #include <netinet/ip6.h>
38 
39 #include <inet/common.h>
40 #include <inet/ip.h>
41 #include <inet/mib2.h>
42 #include <inet/ipclassifier.h>
43 #include "sctp_impl.h"
44 #include "sctp_asconf.h"
45 
46 /* Timer block states. */
47 typedef enum {
48 	SCTP_TB_RUNNING = 1,
49 	SCTP_TB_IDLE,
50 /* Could not stop/free before mblk got queued */
51 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
52 	SCTP_TB_CANCELLED,
53 	SCTP_TB_TO_BE_FREED
54 } timer_block_state;
55 
56 typedef struct sctp_tb_s {
57 	timer_block_state	sctp_tb_state;
58 	timeout_id_t		sctp_tb_tid;
59 	mblk_t			*sctp_tb_mp;
60 	clock_t			sctp_tb_time_left;
61 } sctp_tb_t;
62 
63 static void sctp_timer_fire(sctp_tb_t *);
64 
65 /*
66  *		sctp_timer mechanism.
67  *
68  * Each timer is represented by a timer mblk. When the
69  * timer fires, and the sctp_t is busy, the timer mblk will be put on
70  * the associated sctp_t timer queue so that it can be executed when
71  * the thread holding the lock on the sctp_t is done with its job.
72  *
73  * Note that there is no lock to protect the timer mblk state.  The reason
74  * is that the timer state can only be changed by a thread holding the
75  * lock on the sctp_t.
76  *
77  * The interface consists of 4 entry points:
78  *	sctp_timer_alloc	- create a timer mblk
79  *	sctp_timer_free		- free a timer mblk
80  *	sctp_timer		- start, restart, stop the timer
81  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
82  *				  the timer did indeed fire.
83  */
84 
85 
86 /*
87  * Start, restart, stop the timer.
88  * If "tim" is -1 the timer is stopped.
89  * Otherwise, the timer is stopped if it is already running, and
90  * set to fire tim clock ticks from now.
91  */
92 void
93 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
94 {
95 	sctp_tb_t *sctp_tb;
96 	int state;
97 
98 	ASSERT(sctp != NULL && mp != NULL);
99 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
100 	ASSERT(mp->b_datap->db_type == M_PCSIG);
101 
102 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
103 	if (tim >= 0) {
104 		state = sctp_tb->sctp_tb_state;
105 		sctp_tb->sctp_tb_time_left = tim;
106 		if (state == SCTP_TB_RUNNING) {
107 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
108 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
109 				/* sctp_timer_valid will start timer */
110 				return;
111 			}
112 		} else if (state != SCTP_TB_IDLE) {
113 			ASSERT(state != SCTP_TB_TO_BE_FREED);
114 			if (state == SCTP_TB_CANCELLED) {
115 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
116 				/* sctp_timer_valid will start timer */
117 				return;
118 			}
119 			if (state == SCTP_TB_RESCHED) {
120 				/* sctp_timer_valid will start timer */
121 				return;
122 			}
123 		} else {
124 			SCTP_REFHOLD(sctp);
125 		}
126 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
127 		sctp_tb->sctp_tb_tid =
128 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
129 		return;
130 	}
131 	switch (tim) {
132 	case -1:
133 		sctp_timer_stop(mp);
134 		break;
135 	default:
136 		ASSERT(0);
137 		break;
138 	}
139 }
140 
141 /*
142  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
143  * sctp timer.
144  *
145  * Allocate an M_PCSIG timer message. The space between db_base and
146  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
147  * space for sctpt_t.
148  */
149 mblk_t *
150 sctp_timer_alloc(sctp_t *sctp, pfv_t func)
151 {
152 	mblk_t *mp;
153 	sctp_tb_t *sctp_tb;
154 	sctpt_t	*sctpt;
155 	sctp_stack_t	*sctps = sctp->sctp_sctps;
156 
157 	if ((mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI))) {
158 		mp->b_datap->db_type = M_PCSIG;
159 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
160 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
161 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
162 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
163 		sctp_tb->sctp_tb_mp = mp;
164 
165 		sctpt = (sctpt_t *)mp->b_rptr;
166 		sctpt->sctpt_sctp = sctp;
167 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
168 		sctpt->sctpt_pfv = func;
169 		return (mp);
170 	}
171 	SCTP_KSTAT(sctps, sctp_add_timer);
172 	return (NULL);
173 }
174 
175 /*
176  * timeout() callback function.
177  * Put the message on the process control block's queue.
178  * If the timer is stopped or freed after
179  * it has fired then sctp_timer() and sctp_timer_valid() will clean
180  * things up.
181  */
182 static void
183 sctp_timer_fire(sctp_tb_t *sctp_tb)
184 {
185 	mblk_t *mp;
186 	sctp_t *sctp;
187 	sctpt_t *sctpt;
188 
189 	mp = sctp_tb->sctp_tb_mp;
190 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
191 	ASSERT(mp->b_datap->db_type == M_PCSIG);
192 
193 	sctpt = (sctpt_t *)mp->b_rptr;
194 	sctp = sctpt->sctpt_sctp;
195 	ASSERT(sctp != NULL);
196 
197 	mutex_enter(&sctp->sctp_lock);
198 	if (sctp->sctp_running) {
199 		/*
200 		 * Put the timer mblk to the special sctp_timer_mp list.
201 		 * This timer will be handled when the thread using this
202 		 * SCTP is done with its job.
203 		 */
204 		if (sctp->sctp_timer_mp == NULL) {
205 			SCTP_REFHOLD(sctp);
206 			sctp->sctp_timer_mp = mp;
207 		} else {
208 			linkb(sctp->sctp_timer_mp, mp);
209 		}
210 		mp->b_cont = NULL;
211 		mutex_exit(&sctp->sctp_lock);
212 	} else {
213 		sctp->sctp_running = B_TRUE;
214 		mutex_exit(&sctp->sctp_lock);
215 
216 		sctp_timer_call(sctp, mp);
217 		WAKE_SCTP(sctp);
218 		sctp_process_sendq(sctp);
219 	}
220 	SCTP_REFRELE(sctp);
221 }
222 
223 /*
224  * Logically free a timer mblk (that might have a pending timeout().)
225  * If the timer has fired and the mblk has been put on the queue then
226  * sctp_timer_valid will free the mblk.
227  */
228 void
229 sctp_timer_free(mblk_t *mp)
230 {
231 	sctp_tb_t *sctp_tb;
232 	int state;
233 	sctpt_t *sctpt;
234 
235 	ASSERT(mp != NULL);
236 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
237 	ASSERT(mp->b_datap->db_type == M_PCSIG);
238 
239 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
240 	state = sctp_tb->sctp_tb_state;
241 
242 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
243 
244 	if (state == SCTP_TB_RUNNING) {
245 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
246 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
247 			/* sctp_timer_valid will free the mblk */
248 			return;
249 		}
250 		sctpt = (sctpt_t *)mp->b_rptr;
251 		SCTP_REFRELE(sctpt->sctpt_sctp);
252 	} else if (state != SCTP_TB_IDLE) {
253 		ASSERT(state != SCTP_TB_TO_BE_FREED);
254 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
255 		/* sctp_timer_valid will free the mblk */
256 		return;
257 	}
258 	freeb(mp);
259 }
260 
261 /*
262  * Called from sctp_timer(,,-1)
263  */
264 void
265 sctp_timer_stop(mblk_t *mp)
266 {
267 	sctp_tb_t *sctp_tb;
268 	int state;
269 	sctpt_t *sctpt;
270 
271 	ASSERT(mp != NULL);
272 	ASSERT(mp->b_datap->db_type == M_PCSIG);
273 
274 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
275 	state = sctp_tb->sctp_tb_state;
276 
277 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
278 
279 	if (state == SCTP_TB_RUNNING) {
280 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
281 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
282 		} else {
283 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
284 			sctpt = (sctpt_t *)mp->b_rptr;
285 			SCTP_REFRELE(sctpt->sctpt_sctp);
286 		}
287 	} else if (state == SCTP_TB_RESCHED) {
288 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
289 	}
290 }
291 
292 /*
293  * The user of the sctp_timer mechanism is required to call
294  * sctp_timer_valid() for each M_PCSIG message processed in the
295  * service procedures.
296  * sctp_timer_valid will return "true" if the timer actually did fire.
297  */
298 
299 static boolean_t
300 sctp_timer_valid(mblk_t *mp)
301 {
302 	sctp_tb_t *sctp_tb;
303 	int state;
304 	sctpt_t *sctpt;
305 
306 	ASSERT(mp != NULL);
307 	ASSERT(mp->b_datap->db_type == M_PCSIG);
308 
309 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
310 	sctpt = (sctpt_t *)mp->b_rptr;
311 	state = sctp_tb->sctp_tb_state;
312 	if (state != SCTP_TB_RUNNING) {
313 		ASSERT(state != SCTP_TB_IDLE);
314 		if (state == SCTP_TB_TO_BE_FREED) {
315 			/*
316 			 * sctp_timer_free was called after the message
317 			 * was putq'ed.
318 			 */
319 			freeb(mp);
320 			return (B_FALSE);
321 		}
322 		if (state == SCTP_TB_CANCELLED) {
323 			/* The timer was stopped after the mblk was putq'ed */
324 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
325 			return (B_FALSE);
326 		}
327 		if (state == SCTP_TB_RESCHED) {
328 			/*
329 			 * The timer was stopped and then restarted after
330 			 * the mblk was putq'ed.
331 			 * sctp_tb_time_left contains the number of ticks that
332 			 * the timer was restarted with.
333 			 * The sctp will not be disapper between the time
334 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
335 			 * we get here as sctp_add_recvq() does a refhold.
336 			 */
337 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
338 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
339 			    sctp_tb, sctp_tb->sctp_tb_time_left);
340 			SCTP_REFHOLD(sctpt->sctpt_sctp);
341 			return (B_FALSE);
342 		}
343 	}
344 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
345 	return (B_TRUE);
346 }
347 
348 /*
349  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
350  * timer was cancelled or not.
351  */
352 void
353 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
354 {
355 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
356 
357 	if (sctp_timer_valid(mp)) {
358 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
359 	}
360 }
361 
362 /*
363  * Delayed ack
364  */
365 void
366 sctp_ack_timer(sctp_t *sctp)
367 {
368 	sctp_stack_t	*sctps = sctp->sctp_sctps;
369 
370 	sctp->sctp_ack_timer_running = 0;
371 	sctp->sctp_sack_toggle = sctps->sctps_deferred_acks_max;
372 	BUMP_MIB(&sctps->sctps_mib, sctpOutAckDelayed);
373 	sctp_sack(sctp, NULL);
374 }
375 
376 /*
377  * Peer address heartbeat timer handler
378  */
379 void
380 sctp_heartbeat_timer(sctp_t *sctp)
381 {
382 	sctp_faddr_t	*fp;
383 	int64_t		now;
384 	int64_t		earliest_expiry;
385 	int		cnt;
386 	sctp_stack_t	*sctps = sctp->sctp_sctps;
387 
388 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
389 		/*
390 		 * If there is a peer address with no strikes,
391 		 * don't give up yet. If enough other peer
392 		 * address are down, we could otherwise fail
393 		 * the association prematurely.  This is a
394 		 * byproduct of our aggressive probe approach
395 		 * when a heartbeat fails to connect. We may
396 		 * wish to revisit this...
397 		 */
398 		if (!sctp_is_a_faddr_clean(sctp)) {
399 			/* time to give up */
400 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
401 			BUMP_MIB(&sctps->sctps_mib, sctpTimHeartBeatDrop);
402 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
403 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
404 			    sctp->sctp_client_errno : ETIMEDOUT);
405 			return;
406 		}
407 	}
408 
409 	/* Only send heartbeats in the established state */
410 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
411 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
412 		return;
413 	}
414 
415 	now = lbolt64;
416 	earliest_expiry = 0;
417 	cnt = sctps->sctps_maxburst;
418 
419 	/*
420 	 * Walk through all faddrs.  Since the timer should run infrequently
421 	 * and the number of peer addresses should not be big, this should
422 	 * be OK.
423 	 */
424 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
425 		/*
426 		 * Don't send heartbeat to this address if
427 		 * 1. it is not reachable OR
428 		 * 2. hb_interval == 0 and the address has been confirmed.
429 		 */
430 		if (fp->state == SCTP_FADDRS_UNREACH ||
431 		    (fp->hb_interval == 0 &&
432 		    fp->state != SCTP_FADDRS_UNCONFIRMED)) {
433 			continue;
434 		}
435 
436 		/*
437 		 * The heartbeat timer is expired.  If the address is dead,
438 		 * we still send heartbeat to it in case it becomes alive
439 		 * again.  But we will only send once every hb_interval.
440 		 *
441 		 * If the address is alive and there is a hearbeat pending,
442 		 * resend the heartbeat and start exponential backoff on the
443 		 * heartbeat timeout value.  If there is no heartbeat pending,
444 		 * just send out one.
445 		 */
446 		if (now >= fp->hb_expiry) {
447 			if (fp->hb_pending) {
448 				/*
449 				 * If an address is not confirmed, no need
450 				 * to bump the overall counter as it doesn't
451 				 * matter as we will not use it to send data
452 				 * and it should not affect the association.
453 				 */
454 				switch (fp->state) {
455 				case SCTP_FADDRS_ALIVE:
456 					sctp->sctp_strikes++;
457 					/* FALLTHRU */
458 				case SCTP_FADDRS_UNCONFIRMED:
459 					/*
460 					 * Retransmission implies that RTO
461 					 * is probably not correct.
462 					 */
463 					fp->rtt_updates = 0;
464 					fp->strikes++;
465 					if (fp->strikes > fp->max_retr) {
466 						if (sctp_faddr_dead(sctp, fp,
467 						    SCTP_FADDRS_DOWN) == -1) {
468 							/* Assoc is dead */
469 							return;
470 						}
471 						/*
472 						 * Addr is down; keep initial
473 						 * RTO
474 						 */
475 						fp->rto =
476 						    sctp->sctp_rto_initial;
477 						goto dead_addr;
478 					} else {
479 						SCTP_CALC_RXT(fp,
480 						    sctp->sctp_rto_max);
481 						fp->hb_expiry = now + fp->rto;
482 					}
483 					break;
484 				case SCTP_FADDRS_DOWN:
485 dead_addr:
486 					fp->hb_expiry = now + SET_HB_INTVL(fp);
487 					break;
488 				default:
489 					continue;
490 				}
491 			} else {
492 				fp->hb_expiry = now + fp->rto;
493 			}
494 			/*
495 			 * Note that the total number of heartbeat we can send
496 			 * out simultaneously is limited by sctp_maxburst.  If
497 			 * the limit is exceeded, we need to wait for the next
498 			 * timeout to send them.  This should only happen if
499 			 * there is unconfirmed address.  Note that hb_pending
500 			 * is set in sctp_send_heartbeat().  So if a heartbeat
501 			 * is not sent, it will not affect the state of the
502 			 * peer address.
503 			 */
504 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
505 				sctp_send_heartbeat(sctp, fp);
506 		}
507 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
508 			earliest_expiry = fp->hb_expiry;
509 	}
510 	if (sctp->sctp_autoclose != 0) {
511 		int64_t expire;
512 
513 		expire = sctp->sctp_active + sctp->sctp_autoclose;
514 
515 		if (expire <= now) {
516 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
517 			sctp_send_shutdown(sctp, 0);
518 			return;
519 		}
520 		if (expire < earliest_expiry || earliest_expiry == 0)
521 			earliest_expiry = expire;
522 	}
523 
524 	earliest_expiry -= now;
525 	if (earliest_expiry < 0)
526 		earliest_expiry = 1;
527 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
528 }
529 
530 void
531 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
532 {
533 	mblk_t 		*mp;
534 	uint32_t	rto_max = sctp->sctp_rto_max;
535 	sctp_stack_t	*sctps = sctp->sctp_sctps;
536 
537 	ASSERT(fp != NULL);
538 
539 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
540 	    SCTP_PRINTADDR(fp->faddr)));
541 
542 	fp->timer_running = 0;
543 
544 	/* Check is we've reached the max for retries */
545 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
546 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
547 			/* time to give up */
548 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
549 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
550 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
551 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
552 			    sctp->sctp_client_errno : ETIMEDOUT);
553 			return;
554 		}
555 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
556 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
557 			/* time to give up */
558 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
559 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
560 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
561 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
562 			    sctp->sctp_client_errno : ETIMEDOUT);
563 			return;
564 		}
565 	}
566 
567 	if (fp->strikes >= fp->max_retr) {
568 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
569 			return;
570 		}
571 	}
572 
573 	switch (sctp->sctp_state) {
574 	case SCTPS_ESTABLISHED:
575 		/*
576 		 * Reset the heartbeat expiry time.  We don't need a heartbeat
577 		 * timer running if we are retransmitting.  Otherwise, the drop
578 		 * of heartbeat may just make this peer address to be marked
579 		 * dead faster as fp->strikes is also increased for heartbeat.
580 		 */
581 		fp->hb_expiry = lbolt64 + SET_HB_INTVL(fp);
582 		fp->hb_pending = B_FALSE;
583 
584 		/* FALLTHRU */
585 	case SCTPS_SHUTDOWN_PENDING:
586 	case SCTPS_SHUTDOWN_RECEIVED:
587 		if (sctp->sctp_state == SCTPS_SHUTDOWN_RECEIVED) {
588 			(void) sctp_shutdown_received(sctp, NULL, B_FALSE,
589 			    B_TRUE, NULL);
590 		}
591 
592 		if (sctp->sctp_xmit_head == NULL &&
593 		    sctp->sctp_xmit_unsent == NULL) {
594 			/* Nothing to retransmit */
595 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
596 				sctp_send_shutdown(sctp, 1);
597 			}
598 			return;
599 		}
600 
601 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
602 
603 		sctp_rexmit(sctp, fp);
604 		/*
605 		 * sctp_rexmit() will increase the strikes and restart the
606 		 * timer, so return here.
607 		 */
608 		return;
609 	case SCTPS_COOKIE_WAIT:
610 		BUMP_LOCAL(sctp->sctp_T1expire);
611 rxmit_init:
612 		/* retransmit init */
613 		/*
614 		 * We don't take the conn hash lock here since the source
615 		 * address list won't be modified (it would have been done
616 		 * the first time around).
617 		 */
618 		mp = sctp_init_mp(sctp);
619 		if (mp != NULL) {
620 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
621 			sctp_add_sendq(sctp, mp);
622 		}
623 		rto_max = sctp->sctp_init_rto_max;
624 		break;
625 	case SCTPS_COOKIE_ECHOED: {
626 		ipha_t *iph;
627 
628 		BUMP_LOCAL(sctp->sctp_T1expire);
629 		if (sctp->sctp_cookie_mp == NULL) {
630 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
631 			goto rxmit_init;
632 		}
633 		mp = dupmsg(sctp->sctp_cookie_mp);
634 		if (mp == NULL)
635 			break;
636 		iph = (ipha_t *)mp->b_rptr;
637 		/* Reset the IP ident. */
638 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
639 			iph->ipha_ident = 0;
640 		sctp_add_sendq(sctp, mp);
641 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
642 		rto_max = sctp->sctp_init_rto_max;
643 		break;
644 	}
645 	case SCTPS_SHUTDOWN_SENT:
646 		BUMP_LOCAL(sctp->sctp_T2expire);
647 		sctp_send_shutdown(sctp, 1);
648 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
649 		break;
650 	case SCTPS_SHUTDOWN_ACK_SENT:
651 		/* We shouldn't have any more outstanding data */
652 		ASSERT(sctp->sctp_xmit_head == NULL);
653 		ASSERT(sctp->sctp_xmit_unsent == NULL);
654 
655 		BUMP_LOCAL(sctp->sctp_T2expire);
656 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
657 		    NULL);
658 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
659 		break;
660 	default:
661 		ASSERT(0);
662 		break;
663 	}
664 
665 	fp->strikes++;
666 	sctp->sctp_strikes++;
667 	SCTP_CALC_RXT(fp, rto_max);
668 
669 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
670 }
671 
672 /*
673  * RTO calculation. timesent and now are both in ms.
674  */
675 void
676 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
677 {
678 	int rtt;
679 
680 	/* Calculate the RTT in ms */
681 	rtt = (int)delta;
682 	rtt = rtt > 0 ? rtt : 1;
683 
684 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
685 
686 	/* Is this the first RTT measurement? */
687 	if (fp->srtt == -1) {
688 		fp->srtt = rtt;
689 		fp->rttvar = rtt / 2;
690 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
691 	} else {
692 		int abs;
693 		/*
694 		 * Versions of the RTO equations that use fixed-point math.
695 		 * alpha and beta are NOT tunable in this implementation,
696 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
697 		 */
698 		abs = fp->srtt - rtt;
699 		abs = abs >= 0 ? abs : -abs;
700 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
701 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
702 
703 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
704 		fp->rto = fp->srtt + 4 * fp->rttvar;
705 	}
706 
707 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
708 	    fp->srtt, fp->rttvar, fp->rto));
709 
710 	/* Bound the RTO by configured min and max values */
711 	if (fp->rto < sctp->sctp_rto_min) {
712 		fp->rto = sctp->sctp_rto_min;
713 	}
714 	if (fp->rto > sctp->sctp_rto_max) {
715 		fp->rto = sctp->sctp_rto_max;
716 	}
717 
718 	fp->rtt_updates++;
719 }
720 
721 void
722 sctp_free_faddr_timers(sctp_t *sctp)
723 {
724 	sctp_faddr_t *fp;
725 
726 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
727 		if (fp->timer_mp != NULL) {
728 			sctp_timer_free(fp->timer_mp);
729 			fp->timer_mp = NULL;
730 			fp->timer_running = 0;
731 		}
732 		if (fp->rc_timer_mp != NULL) {
733 			sctp_timer_free(fp->rc_timer_mp);
734 			fp->rc_timer_mp = NULL;
735 			fp->rc_timer_running = 0;
736 		}
737 	}
738 }
739 
740 void
741 sctp_stop_faddr_timers(sctp_t *sctp)
742 {
743 	sctp_faddr_t *fp;
744 
745 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
746 		SCTP_FADDR_TIMER_STOP(fp);
747 		SCTP_FADDR_RC_TIMER_STOP(fp);
748 	}
749 }
750 
751 void
752 sctp_process_timer(sctp_t *sctp)
753 {
754 	mblk_t *mp;
755 
756 	ASSERT(sctp->sctp_running);
757 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
758 	while ((mp = sctp->sctp_timer_mp) != NULL) {
759 		ASSERT(DB_TYPE(mp) == M_PCSIG);
760 		/*
761 		 * Since the timer mblk can be freed in sctp_timer_call(),
762 		 * we need to grab the b_cont before that.
763 		 */
764 		sctp->sctp_timer_mp = mp->b_cont;
765 		mp->b_cont = NULL;
766 		sctp_timer_call(sctp, mp);
767 	}
768 	SCTP_REFRELE(sctp);
769 }
770