xref: /freebsd/sys/netinet/tcp_timer.c (revision 3ef51c5fb9163f2aafb1c14729e06a8bf0c4d113)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet6.h"
36 #include "opt_tcpdebug.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/mbuf.h>
42 #include <sys/mutex.h>
43 #include <sys/protosw.h>
44 #include <sys/smp.h>
45 #include <sys/socket.h>
46 #include <sys/socketvar.h>
47 #include <sys/sysctl.h>
48 #include <sys/systm.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 #include <net/vnet.h>
53 
54 #include <netinet/cc.h>
55 #include <netinet/in.h>
56 #include <netinet/in_pcb.h>
57 #include <netinet/in_systm.h>
58 #ifdef INET6
59 #include <netinet6/in6_pcb.h>
60 #endif
61 #include <netinet/ip_var.h>
62 #include <netinet/tcp_fsm.h>
63 #include <netinet/tcp_timer.h>
64 #include <netinet/tcp_var.h>
65 #include <netinet/tcpip.h>
66 #ifdef TCPDEBUG
67 #include <netinet/tcp_debug.h>
68 #endif
69 
70 int	tcp_keepinit;
71 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT|CTLFLAG_RW,
72     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "time to establish connection");
73 
74 int	tcp_keepidle;
75 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT|CTLFLAG_RW,
76     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "time before keepalive probes begin");
77 
78 int	tcp_keepintvl;
79 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT|CTLFLAG_RW,
80     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "time between keepalive probes");
81 
82 int	tcp_delacktime;
83 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime, CTLTYPE_INT|CTLFLAG_RW,
84     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
85     "Time before a delayed ACK is sent");
86 
87 int	tcp_msl;
88 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT|CTLFLAG_RW,
89     &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
90 
91 int	tcp_rexmit_min;
92 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT|CTLFLAG_RW,
93     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
94     "Minimum Retransmission Timeout");
95 
96 int	tcp_rexmit_slop;
97 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT|CTLFLAG_RW,
98     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
99     "Retransmission Timer Slop");
100 
101 static int	always_keepalive = 1;
102 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_RW,
103     &always_keepalive , 0, "Assume SO_KEEPALIVE on all TCP connections");
104 
105 int    tcp_fast_finwait2_recycle = 0;
106 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
107     &tcp_fast_finwait2_recycle, 0,
108     "Recycle closed FIN_WAIT_2 connections faster");
109 
110 int    tcp_finwait2_timeout;
111 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT|CTLFLAG_RW,
112     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "FIN-WAIT2 timeout");
113 
114 int	tcp_keepcnt = TCPTV_KEEPCNT;
115 SYSCTL_INT(_net_inet_tcp, OID_AUTO, keepcnt, CTLFLAG_RW, &tcp_keepcnt, 0,
116     "Number of keepalive probes to send");
117 
118 	/* max idle probes */
119 int	tcp_maxpersistidle;
120 
121 static int	per_cpu_timers = 0;
122 SYSCTL_INT(_net_inet_tcp, OID_AUTO, per_cpu_timers, CTLFLAG_RW,
123     &per_cpu_timers , 0, "run tcp timers on all cpus");
124 
125 #define	INP_CPU(inp)	(per_cpu_timers ? (!CPU_ABSENT(((inp)->inp_flowid % (mp_maxid+1))) ? \
126 		((inp)->inp_flowid % (mp_maxid+1)) : curcpu) : 0)
127 
128 /*
129  * Tcp protocol timeout routine called every 500 ms.
130  * Updates timestamps used for TCP
131  * causes finite state machine actions if timers expire.
132  */
133 void
134 tcp_slowtimo(void)
135 {
136 	VNET_ITERATOR_DECL(vnet_iter);
137 
138 	VNET_LIST_RLOCK_NOSLEEP();
139 	VNET_FOREACH(vnet_iter) {
140 		CURVNET_SET(vnet_iter);
141 		INP_INFO_WLOCK(&V_tcbinfo);
142 		(void) tcp_tw_2msl_scan(0);
143 		INP_INFO_WUNLOCK(&V_tcbinfo);
144 		CURVNET_RESTORE();
145 	}
146 	VNET_LIST_RUNLOCK_NOSLEEP();
147 }
148 
149 int	tcp_syn_backoff[TCP_MAXRXTSHIFT + 1] =
150     { 1, 1, 1, 1, 1, 2, 4, 8, 16, 32, 64, 64, 64 };
151 
152 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
153     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
154 
155 static int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
156 
157 static int tcp_timer_race;
158 SYSCTL_INT(_net_inet_tcp, OID_AUTO, timer_race, CTLFLAG_RD, &tcp_timer_race,
159     0, "Count of t_inpcb races on tcp_discardcb");
160 
161 /*
162  * TCP timer processing.
163  */
164 
165 void
166 tcp_timer_delack(void *xtp)
167 {
168 	struct tcpcb *tp = xtp;
169 	struct inpcb *inp;
170 	CURVNET_SET(tp->t_vnet);
171 
172 	inp = tp->t_inpcb;
173 	/*
174 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
175 	 * tear-down mean we need it as a work-around for races between
176 	 * timers and tcp_discardcb().
177 	 *
178 	 * KASSERT(inp != NULL, ("tcp_timer_delack: inp == NULL"));
179 	 */
180 	if (inp == NULL) {
181 		tcp_timer_race++;
182 		CURVNET_RESTORE();
183 		return;
184 	}
185 	INP_WLOCK(inp);
186 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_delack)
187 	    || !callout_active(&tp->t_timers->tt_delack)) {
188 		INP_WUNLOCK(inp);
189 		CURVNET_RESTORE();
190 		return;
191 	}
192 	callout_deactivate(&tp->t_timers->tt_delack);
193 
194 	tp->t_flags |= TF_ACKNOW;
195 	TCPSTAT_INC(tcps_delack);
196 	(void) tcp_output(tp);
197 	INP_WUNLOCK(inp);
198 	CURVNET_RESTORE();
199 }
200 
201 void
202 tcp_timer_2msl(void *xtp)
203 {
204 	struct tcpcb *tp = xtp;
205 	struct inpcb *inp;
206 	CURVNET_SET(tp->t_vnet);
207 #ifdef TCPDEBUG
208 	int ostate;
209 
210 	ostate = tp->t_state;
211 #endif
212 	/*
213 	 * XXXRW: Does this actually happen?
214 	 */
215 	INP_INFO_WLOCK(&V_tcbinfo);
216 	inp = tp->t_inpcb;
217 	/*
218 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
219 	 * tear-down mean we need it as a work-around for races between
220 	 * timers and tcp_discardcb().
221 	 *
222 	 * KASSERT(inp != NULL, ("tcp_timer_2msl: inp == NULL"));
223 	 */
224 	if (inp == NULL) {
225 		tcp_timer_race++;
226 		INP_INFO_WUNLOCK(&V_tcbinfo);
227 		CURVNET_RESTORE();
228 		return;
229 	}
230 	INP_WLOCK(inp);
231 	tcp_free_sackholes(tp);
232 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_2msl) ||
233 	    !callout_active(&tp->t_timers->tt_2msl)) {
234 		INP_WUNLOCK(tp->t_inpcb);
235 		INP_INFO_WUNLOCK(&V_tcbinfo);
236 		CURVNET_RESTORE();
237 		return;
238 	}
239 	callout_deactivate(&tp->t_timers->tt_2msl);
240 	/*
241 	 * 2 MSL timeout in shutdown went off.  If we're closed but
242 	 * still waiting for peer to close and connection has been idle
243 	 * too long, or if 2MSL time is up from TIME_WAIT, delete connection
244 	 * control block.  Otherwise, check again in a bit.
245 	 *
246 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
247 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
248 	 * Ignore fact that there were recent incoming segments.
249 	 */
250 	if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
251 	    tp->t_inpcb && tp->t_inpcb->inp_socket &&
252 	    (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
253 		TCPSTAT_INC(tcps_finwait2_drops);
254 		tp = tcp_close(tp);
255 	} else {
256 		if (tp->t_state != TCPS_TIME_WAIT &&
257 		   ticks - tp->t_rcvtime <= TP_MAXIDLE(tp))
258 		       callout_reset_on(&tp->t_timers->tt_2msl,
259 			   TP_KEEPINTVL(tp), tcp_timer_2msl, tp, INP_CPU(inp));
260 	       else
261 		       tp = tcp_close(tp);
262        }
263 
264 #ifdef TCPDEBUG
265 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
266 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
267 			  PRU_SLOWTIMO);
268 #endif
269 	if (tp != NULL)
270 		INP_WUNLOCK(inp);
271 	INP_INFO_WUNLOCK(&V_tcbinfo);
272 	CURVNET_RESTORE();
273 }
274 
275 void
276 tcp_timer_keep(void *xtp)
277 {
278 	struct tcpcb *tp = xtp;
279 	struct tcptemp *t_template;
280 	struct inpcb *inp;
281 	CURVNET_SET(tp->t_vnet);
282 #ifdef TCPDEBUG
283 	int ostate;
284 
285 	ostate = tp->t_state;
286 #endif
287 	INP_INFO_WLOCK(&V_tcbinfo);
288 	inp = tp->t_inpcb;
289 	/*
290 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
291 	 * tear-down mean we need it as a work-around for races between
292 	 * timers and tcp_discardcb().
293 	 *
294 	 * KASSERT(inp != NULL, ("tcp_timer_keep: inp == NULL"));
295 	 */
296 	if (inp == NULL) {
297 		tcp_timer_race++;
298 		INP_INFO_WUNLOCK(&V_tcbinfo);
299 		CURVNET_RESTORE();
300 		return;
301 	}
302 	INP_WLOCK(inp);
303 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_keep)
304 	    || !callout_active(&tp->t_timers->tt_keep)) {
305 		INP_WUNLOCK(inp);
306 		INP_INFO_WUNLOCK(&V_tcbinfo);
307 		CURVNET_RESTORE();
308 		return;
309 	}
310 	callout_deactivate(&tp->t_timers->tt_keep);
311 	/*
312 	 * Keep-alive timer went off; send something
313 	 * or drop connection if idle for too long.
314 	 */
315 	TCPSTAT_INC(tcps_keeptimeo);
316 	if (tp->t_state < TCPS_ESTABLISHED)
317 		goto dropit;
318 	if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
319 	    tp->t_state <= TCPS_CLOSING) {
320 		if (ticks - tp->t_rcvtime >= TP_KEEPIDLE(tp) + TP_MAXIDLE(tp))
321 			goto dropit;
322 		/*
323 		 * Send a packet designed to force a response
324 		 * if the peer is up and reachable:
325 		 * either an ACK if the connection is still alive,
326 		 * or an RST if the peer has closed the connection
327 		 * due to timeout or reboot.
328 		 * Using sequence number tp->snd_una-1
329 		 * causes the transmitted zero-length segment
330 		 * to lie outside the receive window;
331 		 * by the protocol spec, this requires the
332 		 * correspondent TCP to respond.
333 		 */
334 		TCPSTAT_INC(tcps_keepprobe);
335 		t_template = tcpip_maketemplate(inp);
336 		if (t_template) {
337 			tcp_respond(tp, t_template->tt_ipgen,
338 				    &t_template->tt_t, (struct mbuf *)NULL,
339 				    tp->rcv_nxt, tp->snd_una - 1, 0);
340 			free(t_template, M_TEMP);
341 		}
342 		callout_reset_on(&tp->t_timers->tt_keep, TP_KEEPINTVL(tp),
343 		    tcp_timer_keep, tp, INP_CPU(inp));
344 	} else
345 		callout_reset_on(&tp->t_timers->tt_keep, TP_KEEPIDLE(tp),
346 		    tcp_timer_keep, tp, INP_CPU(inp));
347 
348 #ifdef TCPDEBUG
349 	if (inp->inp_socket->so_options & SO_DEBUG)
350 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
351 			  PRU_SLOWTIMO);
352 #endif
353 	INP_WUNLOCK(inp);
354 	INP_INFO_WUNLOCK(&V_tcbinfo);
355 	CURVNET_RESTORE();
356 	return;
357 
358 dropit:
359 	TCPSTAT_INC(tcps_keepdrops);
360 	tp = tcp_drop(tp, ETIMEDOUT);
361 
362 #ifdef TCPDEBUG
363 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
364 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
365 			  PRU_SLOWTIMO);
366 #endif
367 	if (tp != NULL)
368 		INP_WUNLOCK(tp->t_inpcb);
369 	INP_INFO_WUNLOCK(&V_tcbinfo);
370 	CURVNET_RESTORE();
371 }
372 
373 void
374 tcp_timer_persist(void *xtp)
375 {
376 	struct tcpcb *tp = xtp;
377 	struct inpcb *inp;
378 	CURVNET_SET(tp->t_vnet);
379 #ifdef TCPDEBUG
380 	int ostate;
381 
382 	ostate = tp->t_state;
383 #endif
384 	INP_INFO_WLOCK(&V_tcbinfo);
385 	inp = tp->t_inpcb;
386 	/*
387 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
388 	 * tear-down mean we need it as a work-around for races between
389 	 * timers and tcp_discardcb().
390 	 *
391 	 * KASSERT(inp != NULL, ("tcp_timer_persist: inp == NULL"));
392 	 */
393 	if (inp == NULL) {
394 		tcp_timer_race++;
395 		INP_INFO_WUNLOCK(&V_tcbinfo);
396 		CURVNET_RESTORE();
397 		return;
398 	}
399 	INP_WLOCK(inp);
400 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_persist)
401 	    || !callout_active(&tp->t_timers->tt_persist)) {
402 		INP_WUNLOCK(inp);
403 		INP_INFO_WUNLOCK(&V_tcbinfo);
404 		CURVNET_RESTORE();
405 		return;
406 	}
407 	callout_deactivate(&tp->t_timers->tt_persist);
408 	/*
409 	 * Persistance timer into zero window.
410 	 * Force a byte to be output, if possible.
411 	 */
412 	TCPSTAT_INC(tcps_persisttimeo);
413 	/*
414 	 * Hack: if the peer is dead/unreachable, we do not
415 	 * time out if the window is closed.  After a full
416 	 * backoff, drop the connection if the idle time
417 	 * (no responses to probes) reaches the maximum
418 	 * backoff that we would use if retransmitting.
419 	 */
420 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
421 	    (ticks - tp->t_rcvtime >= tcp_maxpersistidle ||
422 	     ticks - tp->t_rcvtime >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
423 		TCPSTAT_INC(tcps_persistdrop);
424 		tp = tcp_drop(tp, ETIMEDOUT);
425 		goto out;
426 	}
427 	tcp_setpersist(tp);
428 	tp->t_flags |= TF_FORCEDATA;
429 	(void) tcp_output(tp);
430 	tp->t_flags &= ~TF_FORCEDATA;
431 
432 out:
433 #ifdef TCPDEBUG
434 	if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
435 		tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
436 #endif
437 	if (tp != NULL)
438 		INP_WUNLOCK(inp);
439 	INP_INFO_WUNLOCK(&V_tcbinfo);
440 	CURVNET_RESTORE();
441 }
442 
443 void
444 tcp_timer_rexmt(void * xtp)
445 {
446 	struct tcpcb *tp = xtp;
447 	CURVNET_SET(tp->t_vnet);
448 	int rexmt;
449 	int headlocked;
450 	struct inpcb *inp;
451 #ifdef TCPDEBUG
452 	int ostate;
453 
454 	ostate = tp->t_state;
455 #endif
456 	INP_INFO_RLOCK(&V_tcbinfo);
457 	inp = tp->t_inpcb;
458 	/*
459 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
460 	 * tear-down mean we need it as a work-around for races between
461 	 * timers and tcp_discardcb().
462 	 *
463 	 * KASSERT(inp != NULL, ("tcp_timer_rexmt: inp == NULL"));
464 	 */
465 	if (inp == NULL) {
466 		tcp_timer_race++;
467 		INP_INFO_RUNLOCK(&V_tcbinfo);
468 		CURVNET_RESTORE();
469 		return;
470 	}
471 	INP_WLOCK(inp);
472 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_rexmt)
473 	    || !callout_active(&tp->t_timers->tt_rexmt)) {
474 		INP_WUNLOCK(inp);
475 		INP_INFO_RUNLOCK(&V_tcbinfo);
476 		CURVNET_RESTORE();
477 		return;
478 	}
479 	callout_deactivate(&tp->t_timers->tt_rexmt);
480 	tcp_free_sackholes(tp);
481 	/*
482 	 * Retransmission timer went off.  Message has not
483 	 * been acked within retransmit interval.  Back off
484 	 * to a longer retransmit interval and retransmit one segment.
485 	 */
486 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
487 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
488 		TCPSTAT_INC(tcps_timeoutdrop);
489 		in_pcbref(inp);
490 		INP_INFO_RUNLOCK(&V_tcbinfo);
491 		INP_WUNLOCK(inp);
492 		INP_INFO_WLOCK(&V_tcbinfo);
493 		INP_WLOCK(inp);
494 		if (in_pcbrele_wlocked(inp)) {
495 			INP_INFO_WUNLOCK(&V_tcbinfo);
496 			CURVNET_RESTORE();
497 			return;
498 		}
499 		if (inp->inp_flags & INP_DROPPED) {
500 			INP_WUNLOCK(inp);
501 			INP_INFO_WUNLOCK(&V_tcbinfo);
502 			CURVNET_RESTORE();
503 			return;
504 		}
505 
506 		tp = tcp_drop(tp, tp->t_softerror ?
507 			      tp->t_softerror : ETIMEDOUT);
508 		headlocked = 1;
509 		goto out;
510 	}
511 	INP_INFO_RUNLOCK(&V_tcbinfo);
512 	headlocked = 0;
513 	if (tp->t_rxtshift == 1) {
514 		/*
515 		 * first retransmit; record ssthresh and cwnd so they can
516 		 * be recovered if this turns out to be a "bad" retransmit.
517 		 * A retransmit is considered "bad" if an ACK for this
518 		 * segment is received within RTT/2 interval; the assumption
519 		 * here is that the ACK was already in flight.  See
520 		 * "On Estimating End-to-End Network Path Properties" by
521 		 * Allman and Paxson for more details.
522 		 */
523 		tp->snd_cwnd_prev = tp->snd_cwnd;
524 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
525 		tp->snd_recover_prev = tp->snd_recover;
526 		if (IN_FASTRECOVERY(tp->t_flags))
527 			tp->t_flags |= TF_WASFRECOVERY;
528 		else
529 			tp->t_flags &= ~TF_WASFRECOVERY;
530 		if (IN_CONGRECOVERY(tp->t_flags))
531 			tp->t_flags |= TF_WASCRECOVERY;
532 		else
533 			tp->t_flags &= ~TF_WASCRECOVERY;
534 		tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
535 		tp->t_flags |= TF_PREVVALID;
536 	} else
537 		tp->t_flags &= ~TF_PREVVALID;
538 	TCPSTAT_INC(tcps_rexmttimeo);
539 	if (tp->t_state == TCPS_SYN_SENT)
540 		rexmt = TCP_REXMTVAL(tp) * tcp_syn_backoff[tp->t_rxtshift];
541 	else
542 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
543 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
544 		      tp->t_rttmin, TCPTV_REXMTMAX);
545 	/*
546 	 * Disable rfc1323 if we haven't got any response to
547 	 * our third SYN to work-around some broken terminal servers
548 	 * (most of which have hopefully been retired) that have bad VJ
549 	 * header compression code which trashes TCP segments containing
550 	 * unknown-to-them TCP options.
551 	 */
552 	if ((tp->t_state == TCPS_SYN_SENT) && (tp->t_rxtshift == 3))
553 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP);
554 	/*
555 	 * If we backed off this far, our srtt estimate is probably bogus.
556 	 * Clobber it so we'll take the next rtt measurement as our srtt;
557 	 * move the current srtt into rttvar to keep the current
558 	 * retransmit times until then.
559 	 */
560 	if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) {
561 #ifdef INET6
562 		if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
563 			in6_losing(tp->t_inpcb);
564 		else
565 #endif
566 		tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT);
567 		tp->t_srtt = 0;
568 	}
569 	tp->snd_nxt = tp->snd_una;
570 	tp->snd_recover = tp->snd_max;
571 	/*
572 	 * Force a segment to be sent.
573 	 */
574 	tp->t_flags |= TF_ACKNOW;
575 	/*
576 	 * If timing a segment in this window, stop the timer.
577 	 */
578 	tp->t_rtttime = 0;
579 
580 	cc_cong_signal(tp, NULL, CC_RTO);
581 
582 	(void) tcp_output(tp);
583 
584 out:
585 #ifdef TCPDEBUG
586 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
587 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
588 			  PRU_SLOWTIMO);
589 #endif
590 	if (tp != NULL)
591 		INP_WUNLOCK(inp);
592 	if (headlocked)
593 		INP_INFO_WUNLOCK(&V_tcbinfo);
594 	CURVNET_RESTORE();
595 }
596 
597 void
598 tcp_timer_activate(struct tcpcb *tp, int timer_type, u_int delta)
599 {
600 	struct callout *t_callout;
601 	void *f_callout;
602 	struct inpcb *inp = tp->t_inpcb;
603 	int cpu = INP_CPU(inp);
604 
605 	switch (timer_type) {
606 		case TT_DELACK:
607 			t_callout = &tp->t_timers->tt_delack;
608 			f_callout = tcp_timer_delack;
609 			break;
610 		case TT_REXMT:
611 			t_callout = &tp->t_timers->tt_rexmt;
612 			f_callout = tcp_timer_rexmt;
613 			break;
614 		case TT_PERSIST:
615 			t_callout = &tp->t_timers->tt_persist;
616 			f_callout = tcp_timer_persist;
617 			break;
618 		case TT_KEEP:
619 			t_callout = &tp->t_timers->tt_keep;
620 			f_callout = tcp_timer_keep;
621 			break;
622 		case TT_2MSL:
623 			t_callout = &tp->t_timers->tt_2msl;
624 			f_callout = tcp_timer_2msl;
625 			break;
626 		default:
627 			panic("bad timer_type");
628 		}
629 	if (delta == 0) {
630 		callout_stop(t_callout);
631 	} else {
632 		callout_reset_on(t_callout, delta, f_callout, tp, cpu);
633 	}
634 }
635 
636 int
637 tcp_timer_active(struct tcpcb *tp, int timer_type)
638 {
639 	struct callout *t_callout;
640 
641 	switch (timer_type) {
642 		case TT_DELACK:
643 			t_callout = &tp->t_timers->tt_delack;
644 			break;
645 		case TT_REXMT:
646 			t_callout = &tp->t_timers->tt_rexmt;
647 			break;
648 		case TT_PERSIST:
649 			t_callout = &tp->t_timers->tt_persist;
650 			break;
651 		case TT_KEEP:
652 			t_callout = &tp->t_timers->tt_keep;
653 			break;
654 		case TT_2MSL:
655 			t_callout = &tp->t_timers->tt_2msl;
656 			break;
657 		default:
658 			panic("bad timer_type");
659 		}
660 	return callout_active(t_callout);
661 }
662 
663 #define	ticks_to_msecs(t)	(1000*(t) / hz)
664 
665 void
666 tcp_timer_to_xtimer(struct tcpcb *tp, struct tcp_timer *timer, struct xtcp_timer *xtimer)
667 {
668 	bzero(xtimer, sizeof(struct xtcp_timer));
669 	if (timer == NULL)
670 		return;
671 	if (callout_active(&timer->tt_delack))
672 		xtimer->tt_delack = ticks_to_msecs(timer->tt_delack.c_time - ticks);
673 	if (callout_active(&timer->tt_rexmt))
674 		xtimer->tt_rexmt = ticks_to_msecs(timer->tt_rexmt.c_time - ticks);
675 	if (callout_active(&timer->tt_persist))
676 		xtimer->tt_persist = ticks_to_msecs(timer->tt_persist.c_time - ticks);
677 	if (callout_active(&timer->tt_keep))
678 		xtimer->tt_keep = ticks_to_msecs(timer->tt_keep.c_time - ticks);
679 	if (callout_active(&timer->tt_2msl))
680 		xtimer->tt_2msl = ticks_to_msecs(timer->tt_2msl.c_time - ticks);
681 	xtimer->t_rcvtime = ticks_to_msecs(ticks - tp->t_rcvtime);
682 }
683