1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 #include <sys/types.h>
29 #include <sys/systm.h>
30 #include <sys/stream.h>
31 #include <sys/cmn_err.h>
32 #include <sys/strsubr.h>
33 #include <sys/strsun.h>
34 
35 #include <netinet/in.h>
36 #include <netinet/ip6.h>
37 
38 #include <inet/common.h>
39 #include <inet/ip.h>
40 #include <inet/mib2.h>
41 #include <inet/ipclassifier.h>
42 #include "sctp_impl.h"
43 #include "sctp_asconf.h"
44 
45 /* Timer block states. */
46 typedef enum {
47 	SCTP_TB_RUNNING = 1,
48 	SCTP_TB_IDLE,
49 /* Could not stop/free before mblk got queued */
50 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
51 	SCTP_TB_CANCELLED,
52 	SCTP_TB_TO_BE_FREED
53 } timer_block_state;
54 
55 typedef struct sctp_tb_s {
56 	timer_block_state	sctp_tb_state;
57 	timeout_id_t		sctp_tb_tid;
58 	mblk_t			*sctp_tb_mp;
59 	clock_t			sctp_tb_time_left;
60 } sctp_tb_t;
61 
62 static void sctp_timer_fire(sctp_tb_t *);
63 
64 /*
65  *		sctp_timer mechanism.
66  *
67  * Each timer is represented by a timer mblk. When the
68  * timer fires, and the sctp_t is busy, the timer mblk will be put on
69  * the associated sctp_t timer queue so that it can be executed when
70  * the thread holding the lock on the sctp_t is done with its job.
71  *
72  * Note that there is no lock to protect the timer mblk state.  The reason
73  * is that the timer state can only be changed by a thread holding the
74  * lock on the sctp_t.
75  *
76  * The interface consists of 4 entry points:
77  *	sctp_timer_alloc	- create a timer mblk
78  *	sctp_timer_free		- free a timer mblk
79  *	sctp_timer		- start, restart, stop the timer
80  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
81  *				  the timer did indeed fire.
82  */
83 
84 
85 /*
86  * Start, restart, stop the timer.
87  * If "tim" is -1 the timer is stopped.
88  * Otherwise, the timer is stopped if it is already running, and
89  * set to fire tim clock ticks from now.
90  */
91 void
92 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
93 {
94 	sctp_tb_t *sctp_tb;
95 	int state;
96 
97 	ASSERT(sctp != NULL && mp != NULL);
98 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
99 	ASSERT(mp->b_datap->db_type == M_PCSIG);
100 
101 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
102 	if (tim >= 0) {
103 		state = sctp_tb->sctp_tb_state;
104 		sctp_tb->sctp_tb_time_left = tim;
105 		if (state == SCTP_TB_RUNNING) {
106 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
107 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
108 				/* sctp_timer_valid will start timer */
109 				return;
110 			}
111 		} else if (state != SCTP_TB_IDLE) {
112 			ASSERT(state != SCTP_TB_TO_BE_FREED);
113 			if (state == SCTP_TB_CANCELLED) {
114 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
115 				/* sctp_timer_valid will start timer */
116 				return;
117 			}
118 			if (state == SCTP_TB_RESCHED) {
119 				/* sctp_timer_valid will start timer */
120 				return;
121 			}
122 		} else {
123 			SCTP_REFHOLD(sctp);
124 		}
125 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
126 		sctp_tb->sctp_tb_tid =
127 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
128 		return;
129 	}
130 	switch (tim) {
131 	case -1:
132 		sctp_timer_stop(mp);
133 		break;
134 	default:
135 		ASSERT(0);
136 		break;
137 	}
138 }
139 
140 /*
141  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
142  * sctp timer.
143  *
144  * Allocate an M_PCSIG timer message. The space between db_base and
145  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
146  * space for sctpt_t.
147  */
148 mblk_t *
149 sctp_timer_alloc(sctp_t *sctp, pfv_t func)
150 {
151 	mblk_t *mp;
152 	sctp_tb_t *sctp_tb;
153 	sctpt_t	*sctpt;
154 
155 	if ((mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI))) {
156 		mp->b_datap->db_type = M_PCSIG;
157 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
158 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
159 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
160 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
161 		sctp_tb->sctp_tb_mp = mp;
162 
163 		sctpt = (sctpt_t *)mp->b_rptr;
164 		sctpt->sctpt_sctp = sctp;
165 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
166 		sctpt->sctpt_pfv = func;
167 		return (mp);
168 	}
169 	return (NULL);
170 }
171 
172 /*
173  * timeout() callback function.
174  * Put the message on the process control block's queue.
175  * If the timer is stopped or freed after
176  * it has fired then sctp_timer() and sctp_timer_valid() will clean
177  * things up.
178  */
179 static void
180 sctp_timer_fire(sctp_tb_t *sctp_tb)
181 {
182 	mblk_t *mp;
183 	sctp_t *sctp;
184 	sctpt_t *sctpt;
185 
186 	mp = sctp_tb->sctp_tb_mp;
187 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
188 	ASSERT(mp->b_datap->db_type == M_PCSIG);
189 
190 	sctpt = (sctpt_t *)mp->b_rptr;
191 	sctp = sctpt->sctpt_sctp;
192 	ASSERT(sctp != NULL);
193 
194 	mutex_enter(&sctp->sctp_lock);
195 	if (sctp->sctp_running) {
196 		/*
197 		 * Put the timer mblk to the special sctp_timer_mp list.
198 		 * This timer will be handled when the thread using this
199 		 * SCTP is done with its job.
200 		 */
201 		if (sctp->sctp_timer_mp == NULL) {
202 			SCTP_REFHOLD(sctp);
203 			sctp->sctp_timer_mp = mp;
204 		} else {
205 			linkb(sctp->sctp_timer_mp, mp);
206 		}
207 		mp->b_cont = NULL;
208 		mutex_exit(&sctp->sctp_lock);
209 	} else {
210 		sctp->sctp_running = B_TRUE;
211 		mutex_exit(&sctp->sctp_lock);
212 
213 		sctp_timer_call(sctp, mp);
214 		WAKE_SCTP(sctp);
215 		sctp_process_sendq(sctp);
216 	}
217 	SCTP_REFRELE(sctp);
218 }
219 
220 /*
221  * Logically free a timer mblk (that might have a pending timeout().)
222  * If the timer has fired and the mblk has been put on the queue then
223  * sctp_timer_valid will free the mblk.
224  */
225 void
226 sctp_timer_free(mblk_t *mp)
227 {
228 	sctp_tb_t *sctp_tb;
229 	int state;
230 	sctpt_t *sctpt;
231 
232 	ASSERT(mp != NULL);
233 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
234 	ASSERT(mp->b_datap->db_type == M_PCSIG);
235 
236 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
237 	state = sctp_tb->sctp_tb_state;
238 
239 	dprint(5, ("sctp_timer_free %p state %d\n", (void *)mp, state));
240 
241 	if (state == SCTP_TB_RUNNING) {
242 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
243 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
244 			/* sctp_timer_valid will free the mblk */
245 			return;
246 		}
247 		sctpt = (sctpt_t *)mp->b_rptr;
248 		SCTP_REFRELE(sctpt->sctpt_sctp);
249 	} else if (state != SCTP_TB_IDLE) {
250 		ASSERT(state != SCTP_TB_TO_BE_FREED);
251 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
252 		/* sctp_timer_valid will free the mblk */
253 		return;
254 	}
255 	freeb(mp);
256 }
257 
258 /*
259  * Called from sctp_timer(,,-1)
260  */
261 void
262 sctp_timer_stop(mblk_t *mp)
263 {
264 	sctp_tb_t *sctp_tb;
265 	int state;
266 	sctpt_t *sctpt;
267 
268 	ASSERT(mp != NULL);
269 	ASSERT(mp->b_datap->db_type == M_PCSIG);
270 
271 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
272 	state = sctp_tb->sctp_tb_state;
273 
274 	dprint(5, ("sctp_timer_stop %p %d\n", (void *)mp, state));
275 
276 	if (state == SCTP_TB_RUNNING) {
277 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
278 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
279 		} else {
280 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
281 			sctpt = (sctpt_t *)mp->b_rptr;
282 			SCTP_REFRELE(sctpt->sctpt_sctp);
283 		}
284 	} else if (state == SCTP_TB_RESCHED) {
285 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
286 	}
287 }
288 
289 /*
290  * The user of the sctp_timer mechanism is required to call
291  * sctp_timer_valid() for each M_PCSIG message processed in the
292  * service procedures.
293  * sctp_timer_valid will return "true" if the timer actually did fire.
294  */
295 
296 static boolean_t
297 sctp_timer_valid(mblk_t *mp)
298 {
299 	sctp_tb_t *sctp_tb;
300 	int state;
301 	sctpt_t *sctpt;
302 
303 	ASSERT(mp != NULL);
304 	ASSERT(mp->b_datap->db_type == M_PCSIG);
305 
306 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
307 	sctpt = (sctpt_t *)mp->b_rptr;
308 	state = sctp_tb->sctp_tb_state;
309 	if (state != SCTP_TB_RUNNING) {
310 		ASSERT(state != SCTP_TB_IDLE);
311 		if (state == SCTP_TB_TO_BE_FREED) {
312 			/*
313 			 * sctp_timer_free was called after the message
314 			 * was putq'ed.
315 			 */
316 			freeb(mp);
317 			return (B_FALSE);
318 		}
319 		if (state == SCTP_TB_CANCELLED) {
320 			/* The timer was stopped after the mblk was putq'ed */
321 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
322 			return (B_FALSE);
323 		}
324 		if (state == SCTP_TB_RESCHED) {
325 			/*
326 			 * The timer was stopped and then restarted after
327 			 * the mblk was putq'ed.
328 			 * sctp_tb_time_left contains the number of ticks that
329 			 * the timer was restarted with.
330 			 * The sctp will not be disapper between the time
331 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
332 			 * we get here as sctp_add_recvq() does a refhold.
333 			 */
334 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
335 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
336 			    sctp_tb, sctp_tb->sctp_tb_time_left);
337 			SCTP_REFHOLD(sctpt->sctpt_sctp);
338 			return (B_FALSE);
339 		}
340 	}
341 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
342 	return (B_TRUE);
343 }
344 
345 /*
346  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
347  * timer was cancelled or not.
348  */
349 void
350 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
351 {
352 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
353 
354 	if (sctp_timer_valid(mp)) {
355 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
356 	}
357 }
358 
359 /*
360  * Delayed ack
361  */
362 void
363 sctp_ack_timer(sctp_t *sctp)
364 {
365 	sctp->sctp_ack_timer_running = 0;
366 	sctp->sctp_sack_toggle = 2;
367 	BUMP_MIB(&sctp_mib, sctpOutAckDelayed);
368 	sctp_sack(sctp, NULL);
369 }
370 
371 /*
372  * Peer address heartbeat timer handler
373  */
374 void
375 sctp_heartbeat_timer(sctp_t *sctp)
376 {
377 	sctp_faddr_t	*fp;
378 	int64_t		now;
379 	int64_t		earliest_expiry;
380 	int		cnt;
381 
382 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
383 		/*
384 		 * If there is a peer address with no strikes,
385 		 * don't give up yet. If enough other peer
386 		 * address are down, we could otherwise fail
387 		 * the association prematurely.  This is a
388 		 * byproduct of our aggressive probe approach
389 		 * when a heartbeat fails to connect. We may
390 		 * wish to revisit this...
391 		 */
392 		if (!sctp_is_a_faddr_clean(sctp)) {
393 			/* time to give up */
394 			BUMP_MIB(&sctp_mib, sctpAborted);
395 			BUMP_MIB(&sctp_mib, sctpTimHeartBeatDrop);
396 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
397 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
398 			    sctp->sctp_client_errno : ETIMEDOUT);
399 			return;
400 		}
401 	}
402 
403 	/* Only send heartbeats in the established state */
404 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
405 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
406 		return;
407 	}
408 
409 	now = lbolt64;
410 	earliest_expiry = 0;
411 	cnt = sctp_maxburst;
412 
413 	/*
414 	 * Walk through all faddrs.  Since the timer should run infrequently
415 	 * and the number of peer addresses should not be big, this should
416 	 * be OK.
417 	 */
418 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
419 		/*
420 		 * Don't send heartbeat to this address if
421 		 * 1. it is not reachable OR
422 		 * 2. hb_interval == 0 and the address has been confirmed.
423 		 */
424 		if (fp->state == SCTP_FADDRS_UNREACH ||
425 		    (fp->hb_interval == 0 &&
426 		    fp->state != SCTP_FADDRS_UNCONFIRMED)) {
427 			continue;
428 		}
429 
430 		/*
431 		 * The heartbeat timer is expired.  If the address is dead,
432 		 * we still send heartbeat to it in case it becomes alive
433 		 * again.  But we will only send once every hb_interval.
434 		 *
435 		 * If the address is alive and there is a hearbeat pending,
436 		 * resend the heartbeat and start exponential backoff on the
437 		 * heartbeat timeout value.  If there is no heartbeat pending,
438 		 * just send out one.
439 		 */
440 		if (now >= fp->hb_expiry) {
441 			if (fp->hb_pending) {
442 				/*
443 				 * If an address is not confirmed, no need
444 				 * to bump the overall counter as it doesn't
445 				 * matter as we will not use it to send data
446 				 * and it should not affect the association.
447 				 */
448 				switch (fp->state) {
449 				case SCTP_FADDRS_ALIVE:
450 					sctp->sctp_strikes++;
451 					/* FALLTHRU */
452 				case SCTP_FADDRS_UNCONFIRMED:
453 					/*
454 					 * Retransmission implies that RTO
455 					 * is probably not correct.
456 					 */
457 					fp->rtt_updates = 0;
458 					fp->strikes++;
459 					if (fp->strikes > fp->max_retr) {
460 						if (sctp_faddr_dead(sctp, fp,
461 						    SCTP_FADDRS_DOWN) == -1) {
462 							/* Assoc is dead */
463 							return;
464 						}
465 						/*
466 						 * Addr is down; keep initial
467 						 * RTO
468 						 */
469 						fp->rto =
470 						    sctp->sctp_rto_initial;
471 						goto dead_addr;
472 					} else {
473 						SCTP_CALC_RXT(fp,
474 						    sctp->sctp_rto_max);
475 						fp->hb_expiry = now + fp->rto;
476 					}
477 					break;
478 				case SCTP_FADDRS_DOWN:
479 dead_addr:
480 					fp->hb_expiry = now + SET_HB_INTVL(fp);
481 					break;
482 				default:
483 					continue;
484 				}
485 			} else {
486 				fp->hb_expiry = now + fp->rto;
487 			}
488 			/*
489 			 * Note that the total number of heartbeat we can send
490 			 * out simultaneously is limited by sctp_maxburst.  If
491 			 * the limit is exceeded, we need to wait for the next
492 			 * timeout to send them.  This should only happen if
493 			 * there is unconfirmed address.  Note that hb_pending
494 			 * is set in sctp_send_heartbeat().  So if a heartbeat
495 			 * is not sent, it will not affect the state of the
496 			 * peer address.
497 			 */
498 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
499 				sctp_send_heartbeat(sctp, fp);
500 		}
501 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
502 			earliest_expiry = fp->hb_expiry;
503 	}
504 	if (sctp->sctp_autoclose != 0) {
505 		int64_t expire;
506 
507 		expire = sctp->sctp_active + sctp->sctp_autoclose;
508 
509 		if (expire <= now) {
510 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
511 			sctp_send_shutdown(sctp, 0);
512 			return;
513 		}
514 		if (expire < earliest_expiry || earliest_expiry == 0)
515 			earliest_expiry = expire;
516 	}
517 
518 	earliest_expiry -= now;
519 	if (earliest_expiry < 0)
520 		earliest_expiry = 1;
521 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
522 }
523 
524 void
525 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
526 {
527 	mblk_t 		*mp;
528 	uint32_t	rto_max = sctp->sctp_rto_max;
529 
530 	ASSERT(fp != NULL);
531 
532 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
533 	    SCTP_PRINTADDR(fp->faddr)));
534 
535 	fp->timer_running = 0;
536 
537 	/* Check is we've reached the max for retries */
538 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
539 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
540 			/* time to give up */
541 			BUMP_MIB(&sctp_mib, sctpAborted);
542 			BUMP_MIB(&sctp_mib, sctpTimRetransDrop);
543 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
544 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
545 			    sctp->sctp_client_errno : ETIMEDOUT);
546 			return;
547 		}
548 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
549 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
550 			/* time to give up */
551 			BUMP_MIB(&sctp_mib, sctpAborted);
552 			BUMP_MIB(&sctp_mib, sctpTimRetransDrop);
553 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
554 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
555 			    sctp->sctp_client_errno : ETIMEDOUT);
556 			return;
557 		}
558 	}
559 
560 	if (fp->strikes >= fp->max_retr) {
561 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
562 			return;
563 		}
564 	}
565 
566 	switch (sctp->sctp_state) {
567 	case SCTPS_ESTABLISHED:
568 		/*
569 		 * Reset the heartbeat expiry time.  We don't need a heartbeat
570 		 * timer running if we are retransmitting.  Otherwise, the drop
571 		 * of heartbeat may just make this peer address to be marked
572 		 * dead faster as fp->strikes is also increased for heartbeat.
573 		 */
574 		fp->hb_expiry = lbolt64 + SET_HB_INTVL(fp);
575 		fp->hb_pending = B_FALSE;
576 
577 		/* FALLTHRU */
578 	case SCTPS_SHUTDOWN_PENDING:
579 	case SCTPS_SHUTDOWN_RECEIVED:
580 		if (sctp->sctp_state == SCTPS_SHUTDOWN_RECEIVED) {
581 			(void) sctp_shutdown_received(sctp, NULL, 0, 1);
582 		}
583 
584 		if (sctp->sctp_xmit_head == NULL &&
585 		    sctp->sctp_xmit_unsent == NULL) {
586 			/* Nothing to retransmit */
587 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
588 				sctp_send_shutdown(sctp, 1);
589 			}
590 			return;
591 		}
592 
593 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
594 
595 		sctp_rexmit(sctp, fp);
596 		/*
597 		 * sctp_rexmit() will increase the strikes and restart the
598 		 * timer, so return here.
599 		 */
600 		return;
601 	case SCTPS_COOKIE_WAIT:
602 		BUMP_LOCAL(sctp->sctp_T1expire);
603 rxmit_init:
604 		/* retransmit init */
605 		/*
606 		 * We don't take the conn hash lock here since the source
607 		 * address list won't be modified (it would have been done
608 		 * the first time around).
609 		 */
610 		mp = sctp_init_mp(sctp);
611 		if (mp != NULL) {
612 			BUMP_MIB(&sctp_mib, sctpTimRetrans);
613 			sctp_add_sendq(sctp, mp);
614 		}
615 		rto_max = sctp->sctp_init_rto_max;
616 		break;
617 	case SCTPS_COOKIE_ECHOED: {
618 		ipha_t *iph;
619 
620 		BUMP_LOCAL(sctp->sctp_T1expire);
621 		if (sctp->sctp_cookie_mp == NULL) {
622 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
623 			goto rxmit_init;
624 		}
625 		mp = dupmsg(sctp->sctp_cookie_mp);
626 		if (mp == NULL)
627 			break;
628 		iph = (ipha_t *)mp->b_rptr;
629 		/* Reset the IP ident. */
630 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
631 			iph->ipha_ident = 0;
632 		sctp_add_sendq(sctp, mp);
633 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
634 		rto_max = sctp->sctp_init_rto_max;
635 		break;
636 	}
637 	case SCTPS_SHUTDOWN_SENT:
638 		BUMP_LOCAL(sctp->sctp_T2expire);
639 		sctp_send_shutdown(sctp, 1);
640 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
641 		break;
642 	case SCTPS_SHUTDOWN_ACK_SENT:
643 		/* We shouldn't have any more outstanding data */
644 		ASSERT(sctp->sctp_xmit_head == NULL);
645 		ASSERT(sctp->sctp_xmit_unsent == NULL);
646 
647 		BUMP_LOCAL(sctp->sctp_T2expire);
648 		(void) sctp_shutdown_received(sctp, NULL, 0, 1);
649 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
650 		break;
651 	default:
652 		ASSERT(0);
653 		break;
654 	}
655 
656 	fp->strikes++;
657 	sctp->sctp_strikes++;
658 	SCTP_CALC_RXT(fp, rto_max);
659 
660 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
661 }
662 
663 /*
664  * RTO calculation. timesent and now are both in ms.
665  */
666 void
667 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
668 {
669 	int rtt;
670 
671 	/* Calculate the RTT in ms */
672 	rtt = (int)delta;
673 	rtt = rtt > 0 ? rtt : 1;
674 
675 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", (void *)fp, rtt));
676 
677 	/* Is this the first RTT measurement? */
678 	if (fp->srtt == -1) {
679 		fp->srtt = rtt;
680 		fp->rttvar = rtt / 2;
681 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
682 	} else {
683 		int abs;
684 		/*
685 		 * Versions of the RTO equations that use fixed-point math.
686 		 * alpha and beta are NOT tunable in this implementation,
687 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
688 		 */
689 		abs = fp->srtt - rtt;
690 		abs = abs >= 0 ? abs : -abs;
691 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
692 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
693 
694 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
695 		fp->rto = fp->srtt + 4 * fp->rttvar;
696 	}
697 
698 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
699 	    fp->srtt, fp->rttvar, fp->rto));
700 
701 	/* Bound the RTO by configured min and max values */
702 	if (fp->rto < sctp->sctp_rto_min) {
703 		fp->rto = sctp->sctp_rto_min;
704 	}
705 	if (fp->rto > sctp->sctp_rto_max) {
706 		fp->rto = sctp->sctp_rto_max;
707 	}
708 
709 	fp->rtt_updates++;
710 }
711 
712 void
713 sctp_free_faddr_timers(sctp_t *sctp)
714 {
715 	sctp_faddr_t *fp;
716 
717 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
718 		if (fp->timer_mp != NULL) {
719 			sctp_timer_free(fp->timer_mp);
720 			fp->timer_mp = NULL;
721 			fp->timer_running = 0;
722 		}
723 		if (fp->rc_timer_mp != NULL) {
724 			sctp_timer_free(fp->rc_timer_mp);
725 			fp->rc_timer_mp = NULL;
726 			fp->rc_timer_running = 0;
727 		}
728 	}
729 }
730 
731 void
732 sctp_stop_faddr_timers(sctp_t *sctp)
733 {
734 	sctp_faddr_t *fp;
735 
736 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
737 		SCTP_FADDR_TIMER_STOP(fp);
738 		SCTP_FADDR_RC_TIMER_STOP(fp);
739 	}
740 }
741 
742 void
743 sctp_process_timer(sctp_t *sctp)
744 {
745 	mblk_t *mp;
746 
747 	ASSERT(sctp->sctp_running);
748 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
749 	while ((mp = sctp->sctp_timer_mp) != NULL) {
750 		ASSERT(DB_TYPE(mp) == M_PCSIG);
751 		/*
752 		 * Since the timer mblk can be freed in sctp_timer_call(),
753 		 * we need to grab the b_cont before that.
754 		 */
755 		sctp->sctp_timer_mp = mp->b_cont;
756 		mp->b_cont = NULL;
757 		sctp_timer_call(sctp, mp);
758 	}
759 	SCTP_REFRELE(sctp);
760 }
761