1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/stream.h>
32 #include <sys/cmn_err.h>
33 #include <sys/strsubr.h>
34 #include <sys/strsun.h>
35 
36 #include <netinet/in.h>
37 #include <netinet/ip6.h>
38 
39 #include <inet/common.h>
40 #include <inet/ip.h>
41 #include <inet/mib2.h>
42 #include <inet/ipclassifier.h>
43 #include "sctp_impl.h"
44 #include "sctp_asconf.h"
45 
46 /* Timer block states. */
47 typedef enum {
48 	SCTP_TB_RUNNING = 1,
49 	SCTP_TB_IDLE,
50 /* Could not stop/free before mblk got queued */
51 	SCTP_TB_RESCHED,	/* sctp_tb_time_left contains tick count */
52 	SCTP_TB_CANCELLED,
53 	SCTP_TB_TO_BE_FREED
54 } timer_block_state;
55 
56 typedef struct sctp_tb_s {
57 	timer_block_state	sctp_tb_state;
58 	timeout_id_t		sctp_tb_tid;
59 	mblk_t			*sctp_tb_mp;
60 	clock_t			sctp_tb_time_left;
61 } sctp_tb_t;
62 
63 static void sctp_timer_fire(sctp_tb_t *);
64 
65 /*
66  *		sctp_timer mechanism.
67  *
68  * Each timer is represented by a timer mblk. When the
69  * timer fires, and the sctp_t is busy, the timer mblk will be put on
70  * the associated sctp_t timer queue so that it can be executed when
71  * the thread holding the lock on the sctp_t is done with its job.
72  *
73  * Note that there is no lock to protect the timer mblk state.  The reason
74  * is that the timer state can only be changed by a thread holding the
75  * lock on the sctp_t.
76  *
77  * The interface consists of 4 entry points:
78  *	sctp_timer_alloc	- create a timer mblk
79  *	sctp_timer_free		- free a timer mblk
80  *	sctp_timer		- start, restart, stop the timer
81  *	sctp_timer_valid	- called by sctp_process_recvq to verify that
82  *				  the timer did indeed fire.
83  */
84 
85 
86 /*
87  * Start, restart, stop the timer.
88  * If "tim" is -1 the timer is stopped.
89  * Otherwise, the timer is stopped if it is already running, and
90  * set to fire tim clock ticks from now.
91  */
92 void
93 sctp_timer(sctp_t *sctp, mblk_t *mp, clock_t tim)
94 {
95 	sctp_tb_t *sctp_tb;
96 	int state;
97 
98 	ASSERT(sctp != NULL && mp != NULL);
99 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
100 	ASSERT(mp->b_datap->db_type == M_PCSIG);
101 
102 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
103 	if (tim >= 0) {
104 		state = sctp_tb->sctp_tb_state;
105 		sctp_tb->sctp_tb_time_left = tim;
106 		if (state == SCTP_TB_RUNNING) {
107 			if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
108 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
109 				/* sctp_timer_valid will start timer */
110 				return;
111 			}
112 		} else if (state != SCTP_TB_IDLE) {
113 			ASSERT(state != SCTP_TB_TO_BE_FREED);
114 			if (state == SCTP_TB_CANCELLED) {
115 				sctp_tb->sctp_tb_state = SCTP_TB_RESCHED;
116 				/* sctp_timer_valid will start timer */
117 				return;
118 			}
119 			if (state == SCTP_TB_RESCHED) {
120 				/* sctp_timer_valid will start timer */
121 				return;
122 			}
123 		} else {
124 			SCTP_REFHOLD(sctp);
125 		}
126 		sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
127 		sctp_tb->sctp_tb_tid =
128 		    timeout((pfv_t)sctp_timer_fire, sctp_tb, tim);
129 		return;
130 	}
131 	switch (tim) {
132 	case -1:
133 		sctp_timer_stop(mp);
134 		break;
135 	default:
136 		ASSERT(0);
137 		break;
138 	}
139 }
140 
141 /*
142  * sctp_timer_alloc is called by sctp_init to allocate and initialize a
143  * sctp timer.
144  *
145  * Allocate an M_PCSIG timer message. The space between db_base and
146  * b_rptr is used by the sctp_timer mechanism, and after b_rptr there is
147  * space for sctpt_t.
148  */
149 mblk_t *
150 sctp_timer_alloc(sctp_t *sctp, pfv_t func)
151 {
152 	mblk_t *mp;
153 	sctp_tb_t *sctp_tb;
154 	sctpt_t	*sctpt;
155 
156 	if ((mp = allocb(sizeof (sctp_t) + sizeof (sctp_tb_t), BPRI_HI))) {
157 		mp->b_datap->db_type = M_PCSIG;
158 		sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
159 		mp->b_rptr = (uchar_t *)&sctp_tb[1];
160 		mp->b_wptr = mp->b_rptr + sizeof (sctpt_t);
161 		sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
162 		sctp_tb->sctp_tb_mp = mp;
163 
164 		sctpt = (sctpt_t *)mp->b_rptr;
165 		sctpt->sctpt_sctp = sctp;
166 		sctpt->sctpt_faddr = NULL;	/* set when starting timer */
167 		sctpt->sctpt_pfv = func;
168 		return (mp);
169 	}
170 	return (NULL);
171 }
172 
173 /*
174  * timeout() callback function.
175  * Put the message on the process control block's queue.
176  * If the timer is stopped or freed after
177  * it has fired then sctp_timer() and sctp_timer_valid() will clean
178  * things up.
179  */
180 static void
181 sctp_timer_fire(sctp_tb_t *sctp_tb)
182 {
183 	mblk_t *mp;
184 	sctp_t *sctp;
185 	sctpt_t *sctpt;
186 
187 	mp = sctp_tb->sctp_tb_mp;
188 	ASSERT(sctp_tb == (sctp_tb_t *)mp->b_datap->db_base);
189 	ASSERT(mp->b_datap->db_type == M_PCSIG);
190 
191 	sctpt = (sctpt_t *)mp->b_rptr;
192 	sctp = sctpt->sctpt_sctp;
193 	ASSERT(sctp != NULL);
194 
195 	mutex_enter(&sctp->sctp_lock);
196 	if (sctp->sctp_running) {
197 		/*
198 		 * Put the timer mblk to the special sctp_timer_mp list.
199 		 * This timer will be handled when the thread using this
200 		 * SCTP is done with its job.
201 		 */
202 		if (sctp->sctp_timer_mp == NULL) {
203 			SCTP_REFHOLD(sctp);
204 			sctp->sctp_timer_mp = mp;
205 		} else {
206 			linkb(sctp->sctp_timer_mp, mp);
207 		}
208 		mp->b_cont = NULL;
209 		mutex_exit(&sctp->sctp_lock);
210 	} else {
211 		sctp->sctp_running = B_TRUE;
212 		mutex_exit(&sctp->sctp_lock);
213 
214 		sctp_timer_call(sctp, mp);
215 		WAKE_SCTP(sctp);
216 		sctp_process_sendq(sctp);
217 	}
218 	SCTP_REFRELE(sctp);
219 }
220 
221 /*
222  * Logically free a timer mblk (that might have a pending timeout().)
223  * If the timer has fired and the mblk has been put on the queue then
224  * sctp_timer_valid will free the mblk.
225  */
226 void
227 sctp_timer_free(mblk_t *mp)
228 {
229 	sctp_tb_t *sctp_tb;
230 	int state;
231 	sctpt_t *sctpt;
232 
233 	ASSERT(mp != NULL);
234 	ASSERT((mp->b_rptr - mp->b_datap->db_base) == sizeof (sctp_tb_t));
235 	ASSERT(mp->b_datap->db_type == M_PCSIG);
236 
237 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
238 	state = sctp_tb->sctp_tb_state;
239 
240 	dprint(5, ("sctp_timer_free %p state %d\n", mp, state));
241 
242 	if (state == SCTP_TB_RUNNING) {
243 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
244 			sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
245 			/* sctp_timer_valid will free the mblk */
246 			return;
247 		}
248 		sctpt = (sctpt_t *)mp->b_rptr;
249 		SCTP_REFRELE(sctpt->sctpt_sctp);
250 	} else if (state != SCTP_TB_IDLE) {
251 		ASSERT(state != SCTP_TB_TO_BE_FREED);
252 		sctp_tb->sctp_tb_state = SCTP_TB_TO_BE_FREED;
253 		/* sctp_timer_valid will free the mblk */
254 		return;
255 	}
256 	freeb(mp);
257 }
258 
259 /*
260  * Called from sctp_timer(,,-1)
261  */
262 void
263 sctp_timer_stop(mblk_t *mp)
264 {
265 	sctp_tb_t *sctp_tb;
266 	int state;
267 	sctpt_t *sctpt;
268 
269 	ASSERT(mp != NULL);
270 	ASSERT(mp->b_datap->db_type == M_PCSIG);
271 
272 	sctp_tb = (sctp_tb_t *)mp->b_datap->db_base;
273 	state = sctp_tb->sctp_tb_state;
274 
275 	dprint(5, ("sctp_timer_stop %p %d\n", mp, state));
276 
277 	if (state == SCTP_TB_RUNNING) {
278 		if (untimeout(sctp_tb->sctp_tb_tid) < 0) {
279 			sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
280 		} else {
281 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
282 			sctpt = (sctpt_t *)mp->b_rptr;
283 			SCTP_REFRELE(sctpt->sctpt_sctp);
284 		}
285 	} else if (state == SCTP_TB_RESCHED) {
286 		sctp_tb->sctp_tb_state = SCTP_TB_CANCELLED;
287 	}
288 }
289 
290 /*
291  * The user of the sctp_timer mechanism is required to call
292  * sctp_timer_valid() for each M_PCSIG message processed in the
293  * service procedures.
294  * sctp_timer_valid will return "true" if the timer actually did fire.
295  */
296 
297 static boolean_t
298 sctp_timer_valid(mblk_t *mp)
299 {
300 	sctp_tb_t *sctp_tb;
301 	int state;
302 	sctpt_t *sctpt;
303 
304 	ASSERT(mp != NULL);
305 	ASSERT(mp->b_datap->db_type == M_PCSIG);
306 
307 	sctp_tb = (sctp_tb_t *)DB_BASE(mp);
308 	sctpt = (sctpt_t *)mp->b_rptr;
309 	state = sctp_tb->sctp_tb_state;
310 	if (state != SCTP_TB_RUNNING) {
311 		ASSERT(state != SCTP_TB_IDLE);
312 		if (state == SCTP_TB_TO_BE_FREED) {
313 			/*
314 			 * sctp_timer_free was called after the message
315 			 * was putq'ed.
316 			 */
317 			freeb(mp);
318 			return (B_FALSE);
319 		}
320 		if (state == SCTP_TB_CANCELLED) {
321 			/* The timer was stopped after the mblk was putq'ed */
322 			sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
323 			return (B_FALSE);
324 		}
325 		if (state == SCTP_TB_RESCHED) {
326 			/*
327 			 * The timer was stopped and then restarted after
328 			 * the mblk was putq'ed.
329 			 * sctp_tb_time_left contains the number of ticks that
330 			 * the timer was restarted with.
331 			 * The sctp will not be disapper between the time
332 			 * the sctpt_t is marked SCTP_TB_RESCHED and when
333 			 * we get here as sctp_add_recvq() does a refhold.
334 			 */
335 			sctp_tb->sctp_tb_state = SCTP_TB_RUNNING;
336 			sctp_tb->sctp_tb_tid = timeout((pfv_t)sctp_timer_fire,
337 			    sctp_tb, sctp_tb->sctp_tb_time_left);
338 			SCTP_REFHOLD(sctpt->sctpt_sctp);
339 			return (B_FALSE);
340 		}
341 	}
342 	sctp_tb->sctp_tb_state = SCTP_TB_IDLE;
343 	return (B_TRUE);
344 }
345 
346 /*
347  * The SCTP timer call. Calls sctp_timer_valid() to verify whether
348  * timer was cancelled or not.
349  */
350 void
351 sctp_timer_call(sctp_t *sctp, mblk_t *mp)
352 {
353 	sctpt_t *sctpt = (sctpt_t *)mp->b_rptr;
354 
355 	if (sctp_timer_valid(mp)) {
356 		(*sctpt->sctpt_pfv)(sctp, sctpt->sctpt_faddr);
357 	}
358 }
359 
360 /*
361  * Delayed ack
362  */
363 void
364 sctp_ack_timer(sctp_t *sctp)
365 {
366 	sctp->sctp_ack_timer_running = 0;
367 	sctp->sctp_sack_toggle = 2;
368 	BUMP_MIB(&sctp_mib, sctpOutAckDelayed);
369 	sctp_sack(sctp, NULL);
370 }
371 
372 /*
373  * Peer address heartbeat timer handler
374  */
375 void
376 sctp_heartbeat_timer(sctp_t *sctp)
377 {
378 	sctp_faddr_t	*fp;
379 	int64_t		now;
380 	int64_t		earliest_expiry;
381 	int		cnt;
382 
383 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
384 		/*
385 		 * If there is a peer address with no strikes,
386 		 * don't give up yet. If enough other peer
387 		 * address are down, we could otherwise fail
388 		 * the association prematurely.  This is a
389 		 * byproduct of our aggressive probe approach
390 		 * when a heartbeat fails to connect. We may
391 		 * wish to revisit this...
392 		 */
393 		if (!sctp_is_a_faddr_clean(sctp)) {
394 			/* time to give up */
395 			BUMP_MIB(&sctp_mib, sctpAborted);
396 			BUMP_MIB(&sctp_mib, sctpTimHeartBeatDrop);
397 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
398 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
399 			    sctp->sctp_client_errno : ETIMEDOUT);
400 			return;
401 		}
402 	}
403 
404 	/* Only send heartbeats in the established state */
405 	if (sctp->sctp_state != SCTPS_ESTABLISHED) {
406 		dprint(5, ("sctp_heartbeat_timer: not in ESTABLISHED\n"));
407 		return;
408 	}
409 
410 	now = lbolt64;
411 	earliest_expiry = 0;
412 	cnt = sctp_maxburst;
413 
414 	/*
415 	 * Walk through all faddrs.  Since the timer should run infrequently
416 	 * and the number of peer addresses should not be big, this should
417 	 * be OK.
418 	 */
419 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
420 		/*
421 		 * Don't send heartbeat to this address if
422 		 * 1. it is not reachable OR
423 		 * 2. hb_interval == 0 and the address has been confirmed.
424 		 */
425 		if (fp->state == SCTP_FADDRS_UNREACH ||
426 		    (fp->hb_interval == 0 &&
427 		    fp->state != SCTP_FADDRS_UNCONFIRMED)) {
428 			continue;
429 		}
430 
431 		/*
432 		 * The heartbeat timer is expired.  If the address is dead,
433 		 * we still send heartbeat to it in case it becomes alive
434 		 * again.  But we will only send once every hb_interval.
435 		 *
436 		 * If the address is alive and there is a hearbeat pending,
437 		 * resend the heartbeat and start exponential backoff on the
438 		 * heartbeat timeout value.  If there is no heartbeat pending,
439 		 * just send out one.
440 		 */
441 		if (now >= fp->hb_expiry) {
442 			if (fp->hb_pending) {
443 				/*
444 				 * If an address is not confirmed, no need
445 				 * to bump the overall counter as it doesn't
446 				 * matter as we will not use it to send data
447 				 * and it should not affect the association.
448 				 */
449 				switch (fp->state) {
450 				case SCTP_FADDRS_ALIVE:
451 					sctp->sctp_strikes++;
452 					/* FALLTHRU */
453 				case SCTP_FADDRS_UNCONFIRMED:
454 					/*
455 					 * Retransmission implies that RTO
456 					 * is probably not correct.
457 					 */
458 					fp->rtt_updates = 0;
459 					fp->strikes++;
460 					if (fp->strikes > fp->max_retr) {
461 						if (sctp_faddr_dead(sctp, fp,
462 						    SCTP_FADDRS_DOWN) == -1) {
463 							/* Assoc is dead */
464 							return;
465 						}
466 						/*
467 						 * Addr is down; keep initial
468 						 * RTO
469 						 */
470 						fp->rto =
471 						    sctp->sctp_rto_initial;
472 						goto dead_addr;
473 					} else {
474 						SCTP_CALC_RXT(fp,
475 						    sctp->sctp_rto_max);
476 						fp->hb_expiry = now + fp->rto;
477 					}
478 					break;
479 				case SCTP_FADDRS_DOWN:
480 dead_addr:
481 					fp->hb_expiry = now + SET_HB_INTVL(fp);
482 					break;
483 				default:
484 					continue;
485 				}
486 			} else {
487 				fp->hb_expiry = now + fp->rto;
488 			}
489 			/*
490 			 * Note that the total number of heartbeat we can send
491 			 * out simultaneously is limited by sctp_maxburst.  If
492 			 * the limit is exceeded, we need to wait for the next
493 			 * timeout to send them.  This should only happen if
494 			 * there is unconfirmed address.  Note that hb_pending
495 			 * is set in sctp_send_heartbeat().  So if a heartbeat
496 			 * is not sent, it will not affect the state of the
497 			 * peer address.
498 			 */
499 			if (fp->state != SCTP_FADDRS_UNCONFIRMED || cnt-- > 0)
500 				sctp_send_heartbeat(sctp, fp);
501 		}
502 		if (fp->hb_expiry < earliest_expiry || earliest_expiry == 0)
503 			earliest_expiry = fp->hb_expiry;
504 	}
505 	if (sctp->sctp_autoclose != 0) {
506 		int64_t expire;
507 
508 		expire = sctp->sctp_active + sctp->sctp_autoclose;
509 
510 		if (expire <= now) {
511 			dprint(3, ("sctp_heartbeat_timer: autoclosing\n"));
512 			sctp_send_shutdown(sctp, 0);
513 			return;
514 		}
515 		if (expire < earliest_expiry || earliest_expiry == 0)
516 			earliest_expiry = expire;
517 	}
518 
519 	earliest_expiry -= now;
520 	if (earliest_expiry < 0)
521 		earliest_expiry = 1;
522 	sctp_timer(sctp, sctp->sctp_heartbeat_mp, earliest_expiry);
523 }
524 
525 void
526 sctp_rexmit_timer(sctp_t *sctp, sctp_faddr_t *fp)
527 {
528 	mblk_t 		*mp;
529 	uint32_t	rto_max = sctp->sctp_rto_max;
530 
531 	ASSERT(fp != NULL);
532 
533 	dprint(3, ("sctp_timer: faddr=%x:%x:%x:%x\n",
534 	    SCTP_PRINTADDR(fp->faddr)));
535 
536 	fp->timer_running = 0;
537 
538 	/* Check is we've reached the max for retries */
539 	if (sctp->sctp_state < SCTPS_ESTABLISHED) {
540 		if (fp->strikes >= sctp->sctp_max_init_rxt) {
541 			/* time to give up */
542 			BUMP_MIB(&sctp_mib, sctpAborted);
543 			BUMP_MIB(&sctp_mib, sctpTimRetransDrop);
544 			sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
545 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
546 			    sctp->sctp_client_errno : ETIMEDOUT);
547 			return;
548 		}
549 	} else if (sctp->sctp_state >= SCTPS_ESTABLISHED) {
550 		if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
551 			/* time to give up */
552 			BUMP_MIB(&sctp_mib, sctpAborted);
553 			BUMP_MIB(&sctp_mib, sctpTimRetransDrop);
554 			sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
555 			sctp_clean_death(sctp, sctp->sctp_client_errno ?
556 			    sctp->sctp_client_errno : ETIMEDOUT);
557 			return;
558 		}
559 	}
560 
561 	if (fp->strikes >= fp->max_retr) {
562 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1) {
563 			return;
564 		}
565 	}
566 
567 	switch (sctp->sctp_state) {
568 	case SCTPS_ESTABLISHED:
569 		/*
570 		 * Reset the heartbeat expiry time.  We don't need a heartbeat
571 		 * timer running if we are retransmitting.  Otherwise, the drop
572 		 * of heartbeat may just make this peer address to be marked
573 		 * dead faster as fp->strikes is also increased for heartbeat.
574 		 */
575 		fp->hb_expiry = lbolt64 + SET_HB_INTVL(fp);
576 		fp->hb_pending = B_FALSE;
577 
578 		/* FALLTHRU */
579 	case SCTPS_SHUTDOWN_PENDING:
580 	case SCTPS_SHUTDOWN_RECEIVED:
581 		if (sctp->sctp_state == SCTPS_SHUTDOWN_RECEIVED) {
582 			(void) sctp_shutdown_received(sctp, NULL, 0, 1);
583 		}
584 
585 		if (sctp->sctp_xmit_head == NULL &&
586 		    sctp->sctp_xmit_unsent == NULL) {
587 			/* Nothing to retransmit */
588 			if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
589 				sctp_send_shutdown(sctp, 1);
590 			}
591 			return;
592 		}
593 
594 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
595 
596 		sctp_rexmit(sctp, fp);
597 		/*
598 		 * sctp_rexmit() will increase the strikes and restart the
599 		 * timer, so return here.
600 		 */
601 		return;
602 	case SCTPS_COOKIE_WAIT:
603 		BUMP_LOCAL(sctp->sctp_T1expire);
604 rxmit_init:
605 		/* retransmit init */
606 		/*
607 		 * We don't take the conn hash lock here since the source
608 		 * address list won't be modified (it would have been done
609 		 * the first time around).
610 		 */
611 		mp = sctp_init_mp(sctp);
612 		if (mp != NULL) {
613 			BUMP_MIB(&sctp_mib, sctpTimRetrans);
614 			sctp_add_sendq(sctp, mp);
615 		}
616 		rto_max = sctp->sctp_init_rto_max;
617 		break;
618 	case SCTPS_COOKIE_ECHOED: {
619 		ipha_t *iph;
620 
621 		BUMP_LOCAL(sctp->sctp_T1expire);
622 		if (sctp->sctp_cookie_mp == NULL) {
623 			sctp->sctp_state = SCTPS_COOKIE_WAIT;
624 			goto rxmit_init;
625 		}
626 		mp = dupmsg(sctp->sctp_cookie_mp);
627 		if (mp == NULL)
628 			break;
629 		iph = (ipha_t *)mp->b_rptr;
630 		/* Reset the IP ident. */
631 		if (IPH_HDR_VERSION(iph) == IPV4_VERSION)
632 			iph->ipha_ident = 0;
633 		sctp_add_sendq(sctp, mp);
634 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
635 		rto_max = sctp->sctp_init_rto_max;
636 		break;
637 	}
638 	case SCTPS_SHUTDOWN_SENT:
639 		BUMP_LOCAL(sctp->sctp_T2expire);
640 		sctp_send_shutdown(sctp, 1);
641 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
642 		break;
643 	case SCTPS_SHUTDOWN_ACK_SENT:
644 		/* We shouldn't have any more outstanding data */
645 		ASSERT(sctp->sctp_xmit_head == NULL);
646 		ASSERT(sctp->sctp_xmit_unsent == NULL);
647 
648 		BUMP_LOCAL(sctp->sctp_T2expire);
649 		(void) sctp_shutdown_received(sctp, NULL, 0, 1);
650 		BUMP_MIB(&sctp_mib, sctpTimRetrans);
651 		break;
652 	default:
653 		ASSERT(0);
654 		break;
655 	}
656 
657 	fp->strikes++;
658 	sctp->sctp_strikes++;
659 	SCTP_CALC_RXT(fp, rto_max);
660 
661 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
662 }
663 
664 /*
665  * RTO calculation. timesent and now are both in ms.
666  */
667 void
668 sctp_update_rtt(sctp_t *sctp, sctp_faddr_t *fp, clock_t delta)
669 {
670 	int rtt;
671 
672 	/* Calculate the RTT in ms */
673 	rtt = (int)delta;
674 	rtt = rtt > 0 ? rtt : 1;
675 
676 	dprint(5, ("sctp_update_rtt: fp = %p, rtt = %d\n", fp, rtt));
677 
678 	/* Is this the first RTT measurement? */
679 	if (fp->srtt == -1) {
680 		fp->srtt = rtt;
681 		fp->rttvar = rtt / 2;
682 		fp->rto = 3 * rtt; /* == rtt + 4 * rttvar ( == rtt / 2) */
683 	} else {
684 		int abs;
685 		/*
686 		 * Versions of the RTO equations that use fixed-point math.
687 		 * alpha and beta are NOT tunable in this implementation,
688 		 * and so are hard-coded in. alpha = 1/8, beta = 1/4.
689 		 */
690 		abs = fp->srtt - rtt;
691 		abs = abs >= 0 ? abs : -abs;
692 		fp->rttvar = (3 * fp->rttvar + abs) >> 2;
693 		fp->rttvar = fp->rttvar != 0 ? fp->rttvar : 1;
694 
695 		fp->srtt = (7 * fp->srtt + rtt) >> 3;
696 		fp->rto = fp->srtt + 4 * fp->rttvar;
697 	}
698 
699 	dprint(5, ("sctp_update_rtt: srtt = %d, rttvar = %d, rto = %d\n",
700 	    fp->srtt, fp->rttvar, fp->rto));
701 
702 	/* Bound the RTO by configured min and max values */
703 	if (fp->rto < sctp->sctp_rto_min) {
704 		fp->rto = sctp->sctp_rto_min;
705 	}
706 	if (fp->rto > sctp->sctp_rto_max) {
707 		fp->rto = sctp->sctp_rto_max;
708 	}
709 
710 	fp->rtt_updates++;
711 }
712 
713 void
714 sctp_free_faddr_timers(sctp_t *sctp)
715 {
716 	sctp_faddr_t *fp;
717 
718 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
719 		if (fp->timer_mp != NULL) {
720 			sctp_timer_free(fp->timer_mp);
721 			fp->timer_mp = NULL;
722 			fp->timer_running = 0;
723 		}
724 		if (fp->rc_timer_mp != NULL) {
725 			sctp_timer_free(fp->rc_timer_mp);
726 			fp->rc_timer_mp = NULL;
727 			fp->rc_timer_running = 0;
728 		}
729 	}
730 }
731 
732 void
733 sctp_stop_faddr_timers(sctp_t *sctp)
734 {
735 	sctp_faddr_t *fp;
736 
737 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
738 		SCTP_FADDR_TIMER_STOP(fp);
739 		SCTP_FADDR_RC_TIMER_STOP(fp);
740 	}
741 }
742 
743 void
744 sctp_process_timer(sctp_t *sctp)
745 {
746 	mblk_t *mp;
747 
748 	ASSERT(sctp->sctp_running);
749 	ASSERT(MUTEX_HELD(&sctp->sctp_lock));
750 	while ((mp = sctp->sctp_timer_mp) != NULL) {
751 		ASSERT(DB_TYPE(mp) == M_PCSIG);
752 		/*
753 		 * Since the timer mblk can be freed in sctp_timer_call(),
754 		 * we need to grab the b_cont before that.
755 		 */
756 		sctp->sctp_timer_mp = mp->b_cont;
757 		mp->b_cont = NULL;
758 		sctp_timer_call(sctp, mp);
759 	}
760 	SCTP_REFRELE(sctp);
761 }
762