xref: /freebsd/sys/netinet/tcp_timer.c (revision 884a2a699669ec61e2366e3e358342dbc94be24a)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet6.h"
36 #include "opt_tcpdebug.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/mbuf.h>
42 #include <sys/mutex.h>
43 #include <sys/protosw.h>
44 #include <sys/smp.h>
45 #include <sys/socket.h>
46 #include <sys/socketvar.h>
47 #include <sys/sysctl.h>
48 #include <sys/systm.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 #include <net/vnet.h>
53 
54 #include <netinet/cc.h>
55 #include <netinet/in.h>
56 #include <netinet/in_pcb.h>
57 #include <netinet/in_systm.h>
58 #ifdef INET6
59 #include <netinet6/in6_pcb.h>
60 #endif
61 #include <netinet/ip_var.h>
62 #include <netinet/tcp_fsm.h>
63 #include <netinet/tcp_timer.h>
64 #include <netinet/tcp_var.h>
65 #include <netinet/tcpip.h>
66 #ifdef TCPDEBUG
67 #include <netinet/tcp_debug.h>
68 #endif
69 
70 int	tcp_keepinit;
71 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT|CTLFLAG_RW,
72     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "time to establish connection");
73 
74 int	tcp_keepidle;
75 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT|CTLFLAG_RW,
76     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "time before keepalive probes begin");
77 
78 int	tcp_keepintvl;
79 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT|CTLFLAG_RW,
80     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "time between keepalive probes");
81 
82 int	tcp_delacktime;
83 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime, CTLTYPE_INT|CTLFLAG_RW,
84     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
85     "Time before a delayed ACK is sent");
86 
87 int	tcp_msl;
88 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT|CTLFLAG_RW,
89     &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
90 
91 int	tcp_rexmit_min;
92 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT|CTLFLAG_RW,
93     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
94     "Minimum Retransmission Timeout");
95 
96 int	tcp_rexmit_slop;
97 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT|CTLFLAG_RW,
98     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
99     "Retransmission Timer Slop");
100 
101 static int	always_keepalive = 1;
102 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_RW,
103     &always_keepalive , 0, "Assume SO_KEEPALIVE on all TCP connections");
104 
105 int    tcp_fast_finwait2_recycle = 0;
106 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
107     &tcp_fast_finwait2_recycle, 0,
108     "Recycle closed FIN_WAIT_2 connections faster");
109 
110 int    tcp_finwait2_timeout;
111 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT|CTLFLAG_RW,
112     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "FIN-WAIT2 timeout");
113 
114 
115 static int	tcp_keepcnt = TCPTV_KEEPCNT;
116 	/* max idle probes */
117 int	tcp_maxpersistidle;
118 	/* max idle time in persist */
119 int	tcp_maxidle;
120 
121 static int	per_cpu_timers = 0;
122 SYSCTL_INT(_net_inet_tcp, OID_AUTO, per_cpu_timers, CTLFLAG_RW,
123     &per_cpu_timers , 0, "run tcp timers on all cpus");
124 
125 #define	INP_CPU(inp)	(per_cpu_timers ? (!CPU_ABSENT(((inp)->inp_flowid % (mp_maxid+1))) ? \
126 		((inp)->inp_flowid % (mp_maxid+1)) : curcpu) : 0)
127 
128 /*
129  * Tcp protocol timeout routine called every 500 ms.
130  * Updates timestamps used for TCP
131  * causes finite state machine actions if timers expire.
132  */
133 void
134 tcp_slowtimo(void)
135 {
136 	VNET_ITERATOR_DECL(vnet_iter);
137 
138 	VNET_LIST_RLOCK_NOSLEEP();
139 	VNET_FOREACH(vnet_iter) {
140 		CURVNET_SET(vnet_iter);
141 		tcp_maxidle = tcp_keepcnt * tcp_keepintvl;
142 		INP_INFO_WLOCK(&V_tcbinfo);
143 		(void) tcp_tw_2msl_scan(0);
144 		INP_INFO_WUNLOCK(&V_tcbinfo);
145 		CURVNET_RESTORE();
146 	}
147 	VNET_LIST_RUNLOCK_NOSLEEP();
148 }
149 
150 int	tcp_syn_backoff[TCP_MAXRXTSHIFT + 1] =
151     { 1, 1, 1, 1, 1, 2, 4, 8, 16, 32, 64, 64, 64 };
152 
153 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
154     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
155 
156 static int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
157 
158 static int tcp_timer_race;
159 SYSCTL_INT(_net_inet_tcp, OID_AUTO, timer_race, CTLFLAG_RD, &tcp_timer_race,
160     0, "Count of t_inpcb races on tcp_discardcb");
161 
162 /*
163  * TCP timer processing.
164  */
165 
166 void
167 tcp_timer_delack(void *xtp)
168 {
169 	struct tcpcb *tp = xtp;
170 	struct inpcb *inp;
171 	CURVNET_SET(tp->t_vnet);
172 
173 	inp = tp->t_inpcb;
174 	/*
175 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
176 	 * tear-down mean we need it as a work-around for races between
177 	 * timers and tcp_discardcb().
178 	 *
179 	 * KASSERT(inp != NULL, ("tcp_timer_delack: inp == NULL"));
180 	 */
181 	if (inp == NULL) {
182 		tcp_timer_race++;
183 		CURVNET_RESTORE();
184 		return;
185 	}
186 	INP_WLOCK(inp);
187 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_delack)
188 	    || !callout_active(&tp->t_timers->tt_delack)) {
189 		INP_WUNLOCK(inp);
190 		CURVNET_RESTORE();
191 		return;
192 	}
193 	callout_deactivate(&tp->t_timers->tt_delack);
194 
195 	tp->t_flags |= TF_ACKNOW;
196 	TCPSTAT_INC(tcps_delack);
197 	(void) tcp_output(tp);
198 	INP_WUNLOCK(inp);
199 	CURVNET_RESTORE();
200 }
201 
202 void
203 tcp_timer_2msl(void *xtp)
204 {
205 	struct tcpcb *tp = xtp;
206 	struct inpcb *inp;
207 	CURVNET_SET(tp->t_vnet);
208 #ifdef TCPDEBUG
209 	int ostate;
210 
211 	ostate = tp->t_state;
212 #endif
213 	/*
214 	 * XXXRW: Does this actually happen?
215 	 */
216 	INP_INFO_WLOCK(&V_tcbinfo);
217 	inp = tp->t_inpcb;
218 	/*
219 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
220 	 * tear-down mean we need it as a work-around for races between
221 	 * timers and tcp_discardcb().
222 	 *
223 	 * KASSERT(inp != NULL, ("tcp_timer_2msl: inp == NULL"));
224 	 */
225 	if (inp == NULL) {
226 		tcp_timer_race++;
227 		INP_INFO_WUNLOCK(&V_tcbinfo);
228 		CURVNET_RESTORE();
229 		return;
230 	}
231 	INP_WLOCK(inp);
232 	tcp_free_sackholes(tp);
233 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_2msl) ||
234 	    !callout_active(&tp->t_timers->tt_2msl)) {
235 		INP_WUNLOCK(tp->t_inpcb);
236 		INP_INFO_WUNLOCK(&V_tcbinfo);
237 		CURVNET_RESTORE();
238 		return;
239 	}
240 	callout_deactivate(&tp->t_timers->tt_2msl);
241 	/*
242 	 * 2 MSL timeout in shutdown went off.  If we're closed but
243 	 * still waiting for peer to close and connection has been idle
244 	 * too long, or if 2MSL time is up from TIME_WAIT, delete connection
245 	 * control block.  Otherwise, check again in a bit.
246 	 *
247 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
248 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
249 	 * Ignore fact that there were recent incoming segments.
250 	 */
251 	if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
252 	    tp->t_inpcb && tp->t_inpcb->inp_socket &&
253 	    (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
254 		TCPSTAT_INC(tcps_finwait2_drops);
255 		tp = tcp_close(tp);
256 	} else {
257 		if (tp->t_state != TCPS_TIME_WAIT &&
258 		   ticks - tp->t_rcvtime <= tcp_maxidle)
259 		       callout_reset_on(&tp->t_timers->tt_2msl, tcp_keepintvl,
260 			   tcp_timer_2msl, tp, INP_CPU(inp));
261 	       else
262 		       tp = tcp_close(tp);
263        }
264 
265 #ifdef TCPDEBUG
266 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
267 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
268 			  PRU_SLOWTIMO);
269 #endif
270 	if (tp != NULL)
271 		INP_WUNLOCK(inp);
272 	INP_INFO_WUNLOCK(&V_tcbinfo);
273 	CURVNET_RESTORE();
274 }
275 
276 void
277 tcp_timer_keep(void *xtp)
278 {
279 	struct tcpcb *tp = xtp;
280 	struct tcptemp *t_template;
281 	struct inpcb *inp;
282 	CURVNET_SET(tp->t_vnet);
283 #ifdef TCPDEBUG
284 	int ostate;
285 
286 	ostate = tp->t_state;
287 #endif
288 	INP_INFO_WLOCK(&V_tcbinfo);
289 	inp = tp->t_inpcb;
290 	/*
291 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
292 	 * tear-down mean we need it as a work-around for races between
293 	 * timers and tcp_discardcb().
294 	 *
295 	 * KASSERT(inp != NULL, ("tcp_timer_keep: inp == NULL"));
296 	 */
297 	if (inp == NULL) {
298 		tcp_timer_race++;
299 		INP_INFO_WUNLOCK(&V_tcbinfo);
300 		CURVNET_RESTORE();
301 		return;
302 	}
303 	INP_WLOCK(inp);
304 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_keep)
305 	    || !callout_active(&tp->t_timers->tt_keep)) {
306 		INP_WUNLOCK(inp);
307 		INP_INFO_WUNLOCK(&V_tcbinfo);
308 		CURVNET_RESTORE();
309 		return;
310 	}
311 	callout_deactivate(&tp->t_timers->tt_keep);
312 	/*
313 	 * Keep-alive timer went off; send something
314 	 * or drop connection if idle for too long.
315 	 */
316 	TCPSTAT_INC(tcps_keeptimeo);
317 	if (tp->t_state < TCPS_ESTABLISHED)
318 		goto dropit;
319 	if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
320 	    tp->t_state <= TCPS_CLOSING) {
321 		if (ticks - tp->t_rcvtime >= tcp_keepidle + tcp_maxidle)
322 			goto dropit;
323 		/*
324 		 * Send a packet designed to force a response
325 		 * if the peer is up and reachable:
326 		 * either an ACK if the connection is still alive,
327 		 * or an RST if the peer has closed the connection
328 		 * due to timeout or reboot.
329 		 * Using sequence number tp->snd_una-1
330 		 * causes the transmitted zero-length segment
331 		 * to lie outside the receive window;
332 		 * by the protocol spec, this requires the
333 		 * correspondent TCP to respond.
334 		 */
335 		TCPSTAT_INC(tcps_keepprobe);
336 		t_template = tcpip_maketemplate(inp);
337 		if (t_template) {
338 			tcp_respond(tp, t_template->tt_ipgen,
339 				    &t_template->tt_t, (struct mbuf *)NULL,
340 				    tp->rcv_nxt, tp->snd_una - 1, 0);
341 			free(t_template, M_TEMP);
342 		}
343 		callout_reset_on(&tp->t_timers->tt_keep, tcp_keepintvl, tcp_timer_keep, tp, INP_CPU(inp));
344 	} else
345 		callout_reset_on(&tp->t_timers->tt_keep, tcp_keepidle, tcp_timer_keep, tp, INP_CPU(inp));
346 
347 #ifdef TCPDEBUG
348 	if (inp->inp_socket->so_options & SO_DEBUG)
349 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
350 			  PRU_SLOWTIMO);
351 #endif
352 	INP_WUNLOCK(inp);
353 	INP_INFO_WUNLOCK(&V_tcbinfo);
354 	CURVNET_RESTORE();
355 	return;
356 
357 dropit:
358 	TCPSTAT_INC(tcps_keepdrops);
359 	tp = tcp_drop(tp, ETIMEDOUT);
360 
361 #ifdef TCPDEBUG
362 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
363 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
364 			  PRU_SLOWTIMO);
365 #endif
366 	if (tp != NULL)
367 		INP_WUNLOCK(tp->t_inpcb);
368 	INP_INFO_WUNLOCK(&V_tcbinfo);
369 	CURVNET_RESTORE();
370 }
371 
372 void
373 tcp_timer_persist(void *xtp)
374 {
375 	struct tcpcb *tp = xtp;
376 	struct inpcb *inp;
377 	CURVNET_SET(tp->t_vnet);
378 #ifdef TCPDEBUG
379 	int ostate;
380 
381 	ostate = tp->t_state;
382 #endif
383 	INP_INFO_WLOCK(&V_tcbinfo);
384 	inp = tp->t_inpcb;
385 	/*
386 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
387 	 * tear-down mean we need it as a work-around for races between
388 	 * timers and tcp_discardcb().
389 	 *
390 	 * KASSERT(inp != NULL, ("tcp_timer_persist: inp == NULL"));
391 	 */
392 	if (inp == NULL) {
393 		tcp_timer_race++;
394 		INP_INFO_WUNLOCK(&V_tcbinfo);
395 		CURVNET_RESTORE();
396 		return;
397 	}
398 	INP_WLOCK(inp);
399 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_persist)
400 	    || !callout_active(&tp->t_timers->tt_persist)) {
401 		INP_WUNLOCK(inp);
402 		INP_INFO_WUNLOCK(&V_tcbinfo);
403 		CURVNET_RESTORE();
404 		return;
405 	}
406 	callout_deactivate(&tp->t_timers->tt_persist);
407 	/*
408 	 * Persistance timer into zero window.
409 	 * Force a byte to be output, if possible.
410 	 */
411 	TCPSTAT_INC(tcps_persisttimeo);
412 	/*
413 	 * Hack: if the peer is dead/unreachable, we do not
414 	 * time out if the window is closed.  After a full
415 	 * backoff, drop the connection if the idle time
416 	 * (no responses to probes) reaches the maximum
417 	 * backoff that we would use if retransmitting.
418 	 */
419 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
420 	    (ticks - tp->t_rcvtime >= tcp_maxpersistidle ||
421 	     ticks - tp->t_rcvtime >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
422 		TCPSTAT_INC(tcps_persistdrop);
423 		tp = tcp_drop(tp, ETIMEDOUT);
424 		goto out;
425 	}
426 	tcp_setpersist(tp);
427 	tp->t_flags |= TF_FORCEDATA;
428 	(void) tcp_output(tp);
429 	tp->t_flags &= ~TF_FORCEDATA;
430 
431 out:
432 #ifdef TCPDEBUG
433 	if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
434 		tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
435 #endif
436 	if (tp != NULL)
437 		INP_WUNLOCK(inp);
438 	INP_INFO_WUNLOCK(&V_tcbinfo);
439 	CURVNET_RESTORE();
440 }
441 
442 void
443 tcp_timer_rexmt(void * xtp)
444 {
445 	struct tcpcb *tp = xtp;
446 	CURVNET_SET(tp->t_vnet);
447 	int rexmt;
448 	int headlocked;
449 	struct inpcb *inp;
450 #ifdef TCPDEBUG
451 	int ostate;
452 
453 	ostate = tp->t_state;
454 #endif
455 	INP_INFO_RLOCK(&V_tcbinfo);
456 	inp = tp->t_inpcb;
457 	/*
458 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
459 	 * tear-down mean we need it as a work-around for races between
460 	 * timers and tcp_discardcb().
461 	 *
462 	 * KASSERT(inp != NULL, ("tcp_timer_rexmt: inp == NULL"));
463 	 */
464 	if (inp == NULL) {
465 		tcp_timer_race++;
466 		INP_INFO_RUNLOCK(&V_tcbinfo);
467 		CURVNET_RESTORE();
468 		return;
469 	}
470 	INP_WLOCK(inp);
471 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_rexmt)
472 	    || !callout_active(&tp->t_timers->tt_rexmt)) {
473 		INP_WUNLOCK(inp);
474 		INP_INFO_RUNLOCK(&V_tcbinfo);
475 		CURVNET_RESTORE();
476 		return;
477 	}
478 	callout_deactivate(&tp->t_timers->tt_rexmt);
479 	tcp_free_sackholes(tp);
480 	/*
481 	 * Retransmission timer went off.  Message has not
482 	 * been acked within retransmit interval.  Back off
483 	 * to a longer retransmit interval and retransmit one segment.
484 	 */
485 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
486 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
487 		TCPSTAT_INC(tcps_timeoutdrop);
488 		in_pcbref(inp);
489 		INP_INFO_RUNLOCK(&V_tcbinfo);
490 		INP_WUNLOCK(inp);
491 		INP_INFO_WLOCK(&V_tcbinfo);
492 		INP_WLOCK(inp);
493 		if (in_pcbrele_wlocked(inp)) {
494 			INP_INFO_WUNLOCK(&V_tcbinfo);
495 			CURVNET_RESTORE();
496 			return;
497 		}
498 		tp = tcp_drop(tp, tp->t_softerror ?
499 			      tp->t_softerror : ETIMEDOUT);
500 		headlocked = 1;
501 		goto out;
502 	}
503 	INP_INFO_RUNLOCK(&V_tcbinfo);
504 	headlocked = 0;
505 	if (tp->t_rxtshift == 1) {
506 		/*
507 		 * first retransmit; record ssthresh and cwnd so they can
508 		 * be recovered if this turns out to be a "bad" retransmit.
509 		 * A retransmit is considered "bad" if an ACK for this
510 		 * segment is received within RTT/2 interval; the assumption
511 		 * here is that the ACK was already in flight.  See
512 		 * "On Estimating End-to-End Network Path Properties" by
513 		 * Allman and Paxson for more details.
514 		 */
515 		tp->snd_cwnd_prev = tp->snd_cwnd;
516 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
517 		tp->snd_recover_prev = tp->snd_recover;
518 		if (IN_FASTRECOVERY(tp->t_flags))
519 			tp->t_flags |= TF_WASFRECOVERY;
520 		else
521 			tp->t_flags &= ~TF_WASFRECOVERY;
522 		if (IN_CONGRECOVERY(tp->t_flags))
523 			tp->t_flags |= TF_WASCRECOVERY;
524 		else
525 			tp->t_flags &= ~TF_WASCRECOVERY;
526 		tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
527 		tp->t_flags |= TF_PREVVALID;
528 	} else
529 		tp->t_flags &= ~TF_PREVVALID;
530 	TCPSTAT_INC(tcps_rexmttimeo);
531 	if (tp->t_state == TCPS_SYN_SENT)
532 		rexmt = TCP_REXMTVAL(tp) * tcp_syn_backoff[tp->t_rxtshift];
533 	else
534 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
535 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
536 		      tp->t_rttmin, TCPTV_REXMTMAX);
537 	/*
538 	 * Disable rfc1323 if we haven't got any response to
539 	 * our third SYN to work-around some broken terminal servers
540 	 * (most of which have hopefully been retired) that have bad VJ
541 	 * header compression code which trashes TCP segments containing
542 	 * unknown-to-them TCP options.
543 	 */
544 	if ((tp->t_state == TCPS_SYN_SENT) && (tp->t_rxtshift == 3))
545 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP);
546 	/*
547 	 * If we backed off this far, our srtt estimate is probably bogus.
548 	 * Clobber it so we'll take the next rtt measurement as our srtt;
549 	 * move the current srtt into rttvar to keep the current
550 	 * retransmit times until then.
551 	 */
552 	if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) {
553 #ifdef INET6
554 		if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
555 			in6_losing(tp->t_inpcb);
556 		else
557 #endif
558 		tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT);
559 		tp->t_srtt = 0;
560 	}
561 	tp->snd_nxt = tp->snd_una;
562 	tp->snd_recover = tp->snd_max;
563 	/*
564 	 * Force a segment to be sent.
565 	 */
566 	tp->t_flags |= TF_ACKNOW;
567 	/*
568 	 * If timing a segment in this window, stop the timer.
569 	 */
570 	tp->t_rtttime = 0;
571 
572 	cc_cong_signal(tp, NULL, CC_RTO);
573 
574 	(void) tcp_output(tp);
575 
576 out:
577 #ifdef TCPDEBUG
578 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
579 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
580 			  PRU_SLOWTIMO);
581 #endif
582 	if (tp != NULL)
583 		INP_WUNLOCK(inp);
584 	if (headlocked)
585 		INP_INFO_WUNLOCK(&V_tcbinfo);
586 	CURVNET_RESTORE();
587 }
588 
589 void
590 tcp_timer_activate(struct tcpcb *tp, int timer_type, u_int delta)
591 {
592 	struct callout *t_callout;
593 	void *f_callout;
594 	struct inpcb *inp = tp->t_inpcb;
595 	int cpu = INP_CPU(inp);
596 
597 	switch (timer_type) {
598 		case TT_DELACK:
599 			t_callout = &tp->t_timers->tt_delack;
600 			f_callout = tcp_timer_delack;
601 			break;
602 		case TT_REXMT:
603 			t_callout = &tp->t_timers->tt_rexmt;
604 			f_callout = tcp_timer_rexmt;
605 			break;
606 		case TT_PERSIST:
607 			t_callout = &tp->t_timers->tt_persist;
608 			f_callout = tcp_timer_persist;
609 			break;
610 		case TT_KEEP:
611 			t_callout = &tp->t_timers->tt_keep;
612 			f_callout = tcp_timer_keep;
613 			break;
614 		case TT_2MSL:
615 			t_callout = &tp->t_timers->tt_2msl;
616 			f_callout = tcp_timer_2msl;
617 			break;
618 		default:
619 			panic("bad timer_type");
620 		}
621 	if (delta == 0) {
622 		callout_stop(t_callout);
623 	} else {
624 		callout_reset_on(t_callout, delta, f_callout, tp, cpu);
625 	}
626 }
627 
628 int
629 tcp_timer_active(struct tcpcb *tp, int timer_type)
630 {
631 	struct callout *t_callout;
632 
633 	switch (timer_type) {
634 		case TT_DELACK:
635 			t_callout = &tp->t_timers->tt_delack;
636 			break;
637 		case TT_REXMT:
638 			t_callout = &tp->t_timers->tt_rexmt;
639 			break;
640 		case TT_PERSIST:
641 			t_callout = &tp->t_timers->tt_persist;
642 			break;
643 		case TT_KEEP:
644 			t_callout = &tp->t_timers->tt_keep;
645 			break;
646 		case TT_2MSL:
647 			t_callout = &tp->t_timers->tt_2msl;
648 			break;
649 		default:
650 			panic("bad timer_type");
651 		}
652 	return callout_active(t_callout);
653 }
654 
655 #define	ticks_to_msecs(t)	(1000*(t) / hz)
656 
657 void
658 tcp_timer_to_xtimer(struct tcpcb *tp, struct tcp_timer *timer, struct xtcp_timer *xtimer)
659 {
660 	bzero(xtimer, sizeof(struct xtcp_timer));
661 	if (timer == NULL)
662 		return;
663 	if (callout_active(&timer->tt_delack))
664 		xtimer->tt_delack = ticks_to_msecs(timer->tt_delack.c_time - ticks);
665 	if (callout_active(&timer->tt_rexmt))
666 		xtimer->tt_rexmt = ticks_to_msecs(timer->tt_rexmt.c_time - ticks);
667 	if (callout_active(&timer->tt_persist))
668 		xtimer->tt_persist = ticks_to_msecs(timer->tt_persist.c_time - ticks);
669 	if (callout_active(&timer->tt_keep))
670 		xtimer->tt_keep = ticks_to_msecs(timer->tt_keep.c_time - ticks);
671 	if (callout_active(&timer->tt_2msl))
672 		xtimer->tt_2msl = ticks_to_msecs(timer->tt_2msl.c_time - ticks);
673 	xtimer->t_rcvtime = ticks_to_msecs(ticks - tp->t_rcvtime);
674 }
675