1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 
28 #include <sys/types.h>
29 #include <sys/systm.h>
30 #include <sys/stream.h>
31 #include <sys/cmn_err.h>
32 #include <sys/strsubr.h>
33 #include <sys/strsun.h>
34 
35 #include <netinet/in.h>
36 #include <netinet/ip6.h>
37 
38 #include <inet/common.h>
39 #include <inet/ip.h>
40 #include <inet/mib2.h>
41 #include <inet/ipclassifier.h>
42 #include "sctp_impl.h"
43 #include "sctp_asconf.h"
44 
45 /* Timer block states. */
46 typedef enum {
47 	SCTP_TB_RUNNING = 1,
48 	SCTP_TB_IDLE,
49 /* Could not stop/free before mblk got queued */
50 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
51 	SCTP_TB_CANCELLED,
52 	SCTP_TB_TO_BE_FREED
53 } timer_block_state;
54 
55 typedef struct sctp_tb_s {
56 	timer_block_state	sctp_tb_state;
57 	timeout_id_t		sctp_tb_tid;
58 	mblk_t			*sctp_tb_mp;
59 	clock_t			sctp_tb_time_left;
60 } sctp_tb_t;
61 
62 static void sctp_timer_fire(sctp_tb_t *);
63 
64 /*
65  *		sctp_timer mechanism.
66  *
67  * Each timer is represented by a timer mblk. When the
68  * timer fires, and the sctp_t is busy, the timer mblk will be put on
69  * the associated sctp_t timer queue so that it can be executed when
70  * the thread holding the lock on the sctp_t is done with its job.
71  *
72  * Note that there is no lock to protect the timer mblk state.  The reason
73  * is that the timer state can only be changed by a thread holding the
74  * lock on the sctp_t.
75  *
76  * The interface consists of 4 entry points:
77  *	sctp_timer_alloc	- create a timer mblk
78  *	sctp_timer_free		- free a timer mblk
79  *	sctp_timer		- start, restart, stop the timer
80  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
81  *				  the timer did indeed fire.
82  */
83 
84 
85 /*
86  * Start, restart, stop the timer.
87  * If "tim" is -1 the timer is stopped.
88  * Otherwise, the timer is stopped if it is already running, and
89  * set to fire tim clock ticks from now.
90  */
91 void
92 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
93 {
94 	sctp_tb_t *sctp_tb;
95 	int state;
96 
97 	ASSERT(sctp != NULL && mp != NULL);
98 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
99 	ASSERT(mp->b_datap->db_type == M_PCSIG);
100 
101 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
102 	if (tim >= 0) {
103 		state = sctp_tb->sctp_tb_state;
104 		sctp_tb->sctp_tb_time_left = tim;
105 		if (state == SCTP_TB_RUNNING) {
106 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
107 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
108 				/* sctp_timer_valid will start timer */
109 				return;
110 			}
111 		} else if (state != SCTP_TB_IDLE) {
112 			ASSERT(state != SCTP_TB_TO_BE_FREED);
113 			if (state == SCTP_TB_CANCELLED) {
114 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
115 				/* sctp_timer_valid will start timer */
116 				return;
117 			}
118 			if (state == SCTP_TB_RESCHED) {
119 				/* sctp_timer_valid will start timer */
120 				return;
121 			}
122 		} else {
123 			SCTP_REFHOLD(sctp);
124 		}
125 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
126 		sctp_tb->sctp_tb_tid =
127 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
128 		return;
129 	}
130 	switch (tim) {
131 	case -1:
132 		sctp_timer_stop(mp);
133 		break;
134 	default:
135 		ASSERT(0);
136 		break;
137 	}
138 }
139 
140 /*
141  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
142  * sctp timer.
143  *
144  * Allocate an M_PCSIG timer message. The space between db_base and
145  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
146  * space for sctpt_t.
147  */
148 mblk_t *
149 sctp_timer_alloc(sctp_t *sctp, pfv_t func, int sleep)
150 {
151 	mblk_t *mp;
152 	sctp_tb_t *sctp_tb;
153 	sctpt_t	*sctpt;
154 	sctp_stack_t	*sctps = sctp->sctp_sctps;
155 
156 	if (sleep == KM_SLEEP) {
157 		mp = allocb_wait(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI,
158 		    STR_NOSIG, NULL);
159 	} else {
160 		mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI);
161 	}
162 	if (mp != NULL) {
163 		mp->b_datap->db_type = M_PCSIG;
164 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
165 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
166 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
167 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
168 		sctp_tb->sctp_tb_mp = mp;
169 
170 		sctpt = (sctpt_t *)mp->b_rptr;
171 		sctpt->sctpt_sctp = sctp;
172 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
173 		sctpt->sctpt_pfv = func;
174 		return (mp);
175 	}
176 	SCTP_KSTAT(sctps, sctp_add_timer);
177 	return (NULL);
178 }
179 
180 /*
181  * timeout() callback function.
182  * Put the message on the process control block's queue.
183  * If the timer is stopped or freed after
184  * it has fired then sctp_timer() and sctp_timer_valid() will clean
185  * things up.
186  */
187 static void
188 sctp_timer_fire(sctp_tb_t *sctp_tb)
189 {
190 	mblk_t *mp;
191 	sctp_t *sctp;
192 	sctpt_t *sctpt;
193 
194 	mp = sctp_tb->sctp_tb_mp;
195 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
196 	ASSERT(mp->b_datap->db_type == M_PCSIG);
197 
198 	sctpt = (sctpt_t *)mp->b_rptr;
199 	sctp = sctpt->sctpt_sctp;
200 	ASSERT(sctp != NULL);
201 
202 	mutex_enter(&sctp->sctp_lock);
203 	if (sctp->sctp_running) {
204 		/*
205 		 * Put the timer mblk to the special sctp_timer_mp list.
206 		 * This timer will be handled when the thread using this
207 		 * SCTP is done with its job.
208 		 */
209 		if (sctp->sctp_timer_mp == NULL) {
210 			SCTP_REFHOLD(sctp);
211 			sctp->sctp_timer_mp = mp;
212 		} else {
213 			linkb(sctp->sctp_timer_mp, mp);
214 		}
215 		mp->b_cont = NULL;
216 		mutex_exit(&sctp->sctp_lock);
217 	} else {
218 		sctp->sctp_running = B_TRUE;
219 		mutex_exit(&sctp->sctp_lock);
220 
221 		sctp_timer_call(sctp, mp);
222 		WAKE_SCTP(sctp);
223 		sctp_process_sendq(sctp);
224 	}
225 	SCTP_REFRELE(sctp);
226 }
227 
228 /*
229  * Logically free a timer mblk (that might have a pending timeout().)
230  * If the timer has fired and the mblk has been put on the queue then
231  * sctp_timer_valid will free the mblk.
232  */
233 void
234 sctp_timer_free(mblk_t *mp)
235 {
236 	sctp_tb_t *sctp_tb;
237 	int state;
238 	sctpt_t *sctpt;
239 
240 	ASSERT(mp != NULL);
241 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
242 	ASSERT(mp->b_datap->db_type == M_PCSIG);
243 
244 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
245 	state = sctp_tb->sctp_tb_state;
246 
247 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
248 
249 	if (state == SCTP_TB_RUNNING) {
250 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
251 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
252 			/* sctp_timer_valid will free the mblk */
253 			return;
254 		}
255 		sctpt = (sctpt_t *)mp->b_rptr;
256 		SCTP_REFRELE(sctpt->sctpt_sctp);
257 	} else if (state != SCTP_TB_IDLE) {
258 		ASSERT(state != SCTP_TB_TO_BE_FREED);
259 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
260 		/* sctp_timer_valid will free the mblk */
261 		return;
262 	}
263 	freeb(mp);
264 }
265 
266 /*
267  * Called from sctp_timer(,,-1)
268  */
269 void
270 sctp_timer_stop(mblk_t *mp)
271 {
272 	sctp_tb_t *sctp_tb;
273 	int state;
274 	sctpt_t *sctpt;
275 
276 	ASSERT(mp != NULL);
277 	ASSERT(mp->b_datap->db_type == M_PCSIG);
278 
279 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
280 	state = sctp_tb->sctp_tb_state;
281 
282 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
283 
284 	if (state == SCTP_TB_RUNNING) {
285 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
286 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
287 		} else {
288 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
289 			sctpt = (sctpt_t *)mp->b_rptr;
290 			SCTP_REFRELE(sctpt->sctpt_sctp);
291 		}
292 	} else if (state == SCTP_TB_RESCHED) {
293 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
294 	}
295 }
296 
297 /*
298  * The user of the sctp_timer mechanism is required to call
299  * sctp_timer_valid() for each M_PCSIG message processed in the
300  * service procedures.
301  * sctp_timer_valid will return "true" if the timer actually did fire.
302  */
303 
304 static boolean_t
305 sctp_timer_valid(mblk_t *mp)
306 {
307 	sctp_tb_t *sctp_tb;
308 	int state;
309 	sctpt_t *sctpt;
310 
311 	ASSERT(mp != NULL);
312 	ASSERT(mp->b_datap->db_type == M_PCSIG);
313 
314 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
315 	sctpt = (sctpt_t *)mp->b_rptr;
316 	state = sctp_tb->sctp_tb_state;
317 	if (state != SCTP_TB_RUNNING) {
318 		ASSERT(state != SCTP_TB_IDLE);
319 		if (state == SCTP_TB_TO_BE_FREED) {
320 			/*
321 			 * sctp_timer_free was called after the message
322 			 * was putq'ed.
323 			 */
324 			freeb(mp);
325 			return (B_FALSE);
326 		}
327 		if (state == SCTP_TB_CANCELLED) {
328 			/* The timer was stopped after the mblk was putq'ed */
329 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
330 			return (B_FALSE);
331 		}
332 		if (state == SCTP_TB_RESCHED) {
333 			/*
334 			 * The timer was stopped and then restarted after
335 			 * the mblk was putq'ed.
336 			 * sctp_tb_time_left contains the number of ticks that
337 			 * the timer was restarted with.
338 			 * The sctp will not be disapper between the time
339 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
340 			 * we get here as sctp_add_recvq() does a refhold.
341 			 */
342 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
343 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
344 			    sctp_tb, sctp_tb->sctp_tb_time_left);
345 			SCTP_REFHOLD(sctpt->sctpt_sctp);
346 			return (B_FALSE);
347 		}
348 	}
349 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
350 	return (B_TRUE);
351 }
352 
353 /*
354  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
355  * timer was cancelled or not.
356  */
357 void
358 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
359 {
360 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
361 
362 	if (sctp_timer_valid(mp)) {
363 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
364 	}
365 }
366 
367 /*
368  * Delayed ack
369  */
370 void
371 sctp_ack_timer(sctp_t *sctp)
372 {
373 	sctp_stack_t	*sctps = sctp->sctp_sctps;
374 
375 	sctp->sctp_ack_timer_running = 0;
376 	sctp->sctp_sack_toggle = sctps->sctps_deferred_acks_max;
377 	BUMP_MIB(&sctps->sctps_mib, sctpOutAckDelayed);
378 	(void) sctp_sack(sctp, NULL);
379 }
380 
381 /*
382  * Peer address heartbeat timer handler
383  */
384 void
385 sctp_heartbeat_timer(sctp_t *sctp)
386 {
387 	sctp_faddr_t	*fp;
388 	int64_t		now;
389 	int64_t		earliest_expiry;
390 	int		cnt;
391 	sctp_stack_t	*sctps = sctp->sctp_sctps;
392 
393 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
394 		/*
395 		 * If there is a peer address with no strikes,
396 		 * don't give up yet. If enough other peer
397 		 * address are down, we could otherwise fail
398 		 * the association prematurely.  This is a
399 		 * byproduct of our aggressive probe approach
400 		 * when a heartbeat fails to connect. We may
401 		 * wish to revisit this...
402 		 */
403 		if (!sctp_is_a_faddr_clean(sctp)) {
404 			/* time to give up */
405 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
406 			BUMP_MIB(&sctps->sctps_mib, sctpTimHeartBeatDrop);
407 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
408 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
409 			    sctp->sctp_client_errno : ETIMEDOUT);
410 			return;
411 		}
412 	}
413 
414 	/* Only send heartbeats in the established state */
415 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
416 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
417 		return;
418 	}
419 
420 	now = lbolt64;
421 	earliest_expiry = 0;
422 	cnt = sctps->sctps_maxburst;
423 
424 	/*
425 	 * Walk through all faddrs.  Since the timer should run infrequently
426 	 * and the number of peer addresses should not be big, this should
427 	 * be OK.
428 	 */
429 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
430 		/*
431 		 * If the peer is unreachable because there is no available
432 		 * source address, call sctp_get_ire() to see if it is
433 		 * reachable now.  If it is OK, the state will become
434 		 * unconfirmed.  And the following code to handle unconfirmed
435 		 * address will be executed.  If it is still not OK,
436 		 * re-schedule.  If heartbeat is enabled, only try this
437 		 * up to the normal heartbeat max times.  But if heartbeat
438 		 * is disable, this retry may go on forever.
439 		 */
440 		if (fp->state == SCTP_FADDRS_UNREACH) {
441 			sctp_get_ire(sctp, fp);
442 			if (fp->state == SCTP_FADDRS_UNREACH) {
443 				if (fp->hb_enabled &&
444 				    ++fp->strikes > fp->max_retr &&
445 				    sctp_faddr_dead(sctp, fp,
446 				    SCTP_FADDRS_DOWN) == -1) {
447 					/* Assoc is dead */
448 					return;
449 				}
450 				fp->hb_expiry = now + SET_HB_INTVL(fp);
451 				goto set_expiry;
452 			} else {
453 				/* Send a heartbeat immediately. */
454 				fp->hb_expiry = now;
455 			}
456 		}
457 		/*
458 		 * Don't send heartbeat to this address if it is not
459 		 * hb_enabled and the address has been confirmed.
460 		 */
461 		if (!fp->hb_enabled && fp->state != SCTP_FADDRS_UNCONFIRMED) {
462 			continue;
463 		}
464 
465 		/*
466 		 * The heartbeat timer is expired.  If the address is dead,
467 		 * we still send heartbeat to it in case it becomes alive
468 		 * again.  But we will only send once in a while, calculated
469 		 * by SET_HB_INTVL().
470 		 *
471 		 * If the address is alive and there is a hearbeat pending,
472 		 * resend the heartbeat and start exponential backoff on the
473 		 * heartbeat timeout value.  If there is no heartbeat pending,
474 		 * just send out one.
475 		 */
476 		if (now >= fp->hb_expiry) {
477 			if (fp->hb_pending) {
478 				/*
479 				 * If an address is not confirmed, no need
480 				 * to bump the overall counter as it doesn't
481 				 * matter as we will not use it to send data
482 				 * and it should not affect the association.
483 				 */
484 				switch (fp->state) {
485 				case SCTP_FADDRS_ALIVE:
486 					sctp->sctp_strikes++;
487 					/* FALLTHRU */
488 				case SCTP_FADDRS_UNCONFIRMED:
489 					/*
490 					 * Retransmission implies that RTO
491 					 * is probably not correct.
492 					 */
493 					fp->rtt_updates = 0;
494 					fp->strikes++;
495 					if (fp->strikes > fp->max_retr) {
496 						if (sctp_faddr_dead(sctp, fp,
497 						    SCTP_FADDRS_DOWN) == -1) {
498 							/* Assoc is dead */
499 							return;
500 						}
501 						/*
502 						 * Addr is down; keep initial
503 						 * RTO
504 						 */
505 						fp->rto =
506 						    sctp->sctp_rto_initial;
507 						goto dead_addr;
508 					} else {
509 						SCTP_CALC_RXT(fp,
510 						    sctp->sctp_rto_max);
511 						fp->hb_expiry = now + fp->rto;
512 					}
513 					break;
514 				case SCTP_FADDRS_DOWN:
515 dead_addr:
516 					fp->hb_expiry = now + SET_HB_INTVL(fp);
517 					break;
518 				default:
519 					continue;
520 				}
521 			} else {
522 				/*
523 				 * If there is unack'ed data, no need to
524 				 * send a heart beat.
525 				 */
526 				if (fp->suna > 0) {
527 					fp->hb_expiry = now + SET_HB_INTVL(fp);
528 					goto set_expiry;
529 				} else {
530 					fp->hb_expiry = now + fp->rto;
531 				}
532 			}
533 			/*
534 			 * Note that the total number of heartbeat we can send
535 			 * out simultaneously is limited by sctp_maxburst.  If
536 			 * the limit is exceeded, we need to wait for the next
537 			 * timeout to send them.  This should only happen if
538 			 * there is unconfirmed address.  Note that hb_pending
539 			 * is set in sctp_send_heartbeat().  So if a heartbeat
540 			 * is not sent, it will not affect the state of the
541 			 * peer address.
542 			 */
543 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
544 				sctp_send_heartbeat(sctp, fp);
545 		}
546 set_expiry:
547 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
548 			earliest_expiry = fp->hb_expiry;
549 	}
550 	if (sctp->sctp_autoclose != 0) {
551 		int64_t expire;
552 
553 		expire = sctp->sctp_active + sctp->sctp_autoclose;
554 
555 		if (expire <= now) {
556 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
557 			sctp_send_shutdown(sctp, 0);
558 			return;
559 		}
560 		if (expire < earliest_expiry || earliest_expiry == 0)
561 			earliest_expiry = expire;
562 	}
563 
564 	earliest_expiry -= now;
565 	if (earliest_expiry < 0)
566 		earliest_expiry = 1;
567 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
568 }
569 
570 void
571 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
572 {
573 	mblk_t 		*mp;
574 	uint32_t	rto_max = sctp->sctp_rto_max;
575 	sctp_stack_t	*sctps = sctp->sctp_sctps;
576 
577 	ASSERT(fp != NULL);
578 
579 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
580 	    SCTP_PRINTADDR(fp->faddr)));
581 
582 	fp->timer_running = 0;
583 
584 	/* Check is we've reached the max for retries */
585 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
586 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
587 			/* time to give up */
588 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
589 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
590 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
591 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
592 			    sctp->sctp_client_errno : ETIMEDOUT);
593 			return;
594 		}
595 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
596 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
597 			/* time to give up */
598 			BUMP_MIB(&sctps->sctps_mib, sctpAborted);
599 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetransDrop);
600 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
601 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
602 			    sctp->sctp_client_errno : ETIMEDOUT);
603 			return;
604 		}
605 	}
606 
607 	if (fp->strikes >= fp->max_retr) {
608 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
609 			return;
610 		}
611 	}
612 
613 	switch (sctp->sctp_state) {
614 	case SCTPS_SHUTDOWN_RECEIVED:
615 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
616 		    NULL);
617 
618 		/* FALLTHRU */
619 	case SCTPS_ESTABLISHED:
620 	case SCTPS_SHUTDOWN_PENDING:
621 		if (sctp->sctp_xmit_head == NULL &&
622 		    sctp->sctp_xmit_unsent == NULL) {
623 			/* Nothing to retransmit */
624 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
625 				sctp_send_shutdown(sctp, 1);
626 			}
627 			return;
628 		}
629 
630 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
631 
632 		sctp_rexmit(sctp, fp);
633 		/*
634 		 * sctp_rexmit() will increase the strikes and restart the
635 		 * timer, so return here.
636 		 */
637 		return;
638 	case SCTPS_COOKIE_WAIT:
639 		BUMP_LOCAL(sctp->sctp_T1expire);
640 rxmit_init:
641 		/* retransmit init */
642 		/*
643 		 * We don't take the conn hash lock here since the source
644 		 * address list won't be modified (it would have been done
645 		 * the first time around).
646 		 */
647 		mp = sctp_init_mp(sctp);
648 		if (mp != NULL) {
649 			BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
650 			sctp_add_sendq(sctp, mp);
651 		}
652 		rto_max = sctp->sctp_init_rto_max;
653 		break;
654 	case SCTPS_COOKIE_ECHOED: {
655 		ipha_t *iph;
656 
657 		BUMP_LOCAL(sctp->sctp_T1expire);
658 		if (sctp->sctp_cookie_mp == NULL) {
659 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
660 			goto rxmit_init;
661 		}
662 		mp = dupmsg(sctp->sctp_cookie_mp);
663 		if (mp == NULL)
664 			break;
665 		iph = (ipha_t *)mp->b_rptr;
666 		/* Reset the IP ident. */
667 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
668 			iph->ipha_ident = 0;
669 		sctp_add_sendq(sctp, mp);
670 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
671 		rto_max = sctp->sctp_init_rto_max;
672 		break;
673 	}
674 	case SCTPS_SHUTDOWN_SENT:
675 		BUMP_LOCAL(sctp->sctp_T2expire);
676 		sctp_send_shutdown(sctp, 1);
677 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
678 		break;
679 	case SCTPS_SHUTDOWN_ACK_SENT:
680 		/* We shouldn't have any more outstanding data */
681 		ASSERT(sctp->sctp_xmit_head == NULL);
682 		ASSERT(sctp->sctp_xmit_unsent == NULL);
683 
684 		BUMP_LOCAL(sctp->sctp_T2expire);
685 		(void) sctp_shutdown_received(sctp, NULL, B_FALSE, B_TRUE,
686 		    NULL);
687 		BUMP_MIB(&sctps->sctps_mib, sctpTimRetrans);
688 		break;
689 	default:
690 		ASSERT(0);
691 		break;
692 	}
693 
694 	fp->strikes++;
695 	sctp->sctp_strikes++;
696 	SCTP_CALC_RXT(fp, rto_max);
697 
698 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
699 }
700 
701 /*
702  * RTO calculation. timesent and now are both in ms.
703  */
704 void
705 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
706 {
707 	int rtt;
708 
709 	/* Calculate the RTT in ms */
710 	rtt = (int)delta;
711 	rtt = rtt > 0 ? rtt : 1;
712 
713 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
714 
715 	/* Is this the first RTT measurement? */
716 	if (fp->srtt == -1) {
717 		fp->srtt = rtt;
718 		fp->rttvar = rtt / 2;
719 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
720 	} else {
721 		int abs;
722 		/*
723 		 * Versions of the RTO equations that use fixed-point math.
724 		 * alpha and beta are NOT tunable in this implementation,
725 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
726 		 */
727 		abs = fp->srtt - rtt;
728 		abs = abs >= 0 ? abs : -abs;
729 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
730 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
731 
732 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
733 		fp->rto = fp->srtt + 4 * fp->rttvar;
734 	}
735 
736 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
737 	    fp->srtt, fp->rttvar, fp->rto));
738 
739 	/* Bound the RTO by configured min and max values */
740 	if (fp->rto < sctp->sctp_rto_min) {
741 		fp->rto = sctp->sctp_rto_min;
742 	}
743 	if (fp->rto > sctp->sctp_rto_max) {
744 		fp->rto = sctp->sctp_rto_max;
745 	}
746 
747 	fp->rtt_updates++;
748 }
749 
750 void
751 sctp_free_faddr_timers(sctp_t *sctp)
752 {
753 	sctp_faddr_t *fp;
754 
755 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
756 		if (fp->timer_mp != NULL) {
757 			sctp_timer_free(fp->timer_mp);
758 			fp->timer_mp = NULL;
759 			fp->timer_running = 0;
760 		}
761 		if (fp->rc_timer_mp != NULL) {
762 			sctp_timer_free(fp->rc_timer_mp);
763 			fp->rc_timer_mp = NULL;
764 			fp->rc_timer_running = 0;
765 		}
766 	}
767 }
768 
769 void
770 sctp_stop_faddr_timers(sctp_t *sctp)
771 {
772 	sctp_faddr_t *fp;
773 
774 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
775 		SCTP_FADDR_TIMER_STOP(fp);
776 		SCTP_FADDR_RC_TIMER_STOP(fp);
777 	}
778 }
779 
780 void
781 sctp_process_timer(sctp_t *sctp)
782 {
783 	mblk_t *mp;
784 
785 	ASSERT(sctp->sctp_running);
786 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
787 	while ((mp = sctp->sctp_timer_mp) != NULL) {
788 		ASSERT(DB_TYPE(mp) == M_PCSIG);
789 		/*
790 		 * Since the timer mblk can be freed in sctp_timer_call(),
791 		 * we need to grab the b_cont before that.
792 		 */
793 		sctp->sctp_timer_mp = mp->b_cont;
794 		mp->b_cont = NULL;
795 		/*
796 		 * We have a reference on the sctp, the lock must be
797 		 * dropped to avoid deadlocks with functions potentially
798 		 * called in this context which in turn call untimeout().
799 		 */
800 		mutex_exit(&sctp->sctp_lock);
801 		sctp_timer_call(sctp, mp);
802 		mutex_enter(&sctp->sctp_lock);
803 	}
804 	SCTP_REFRELE(sctp);
805 }
806