xref: /freebsd/sys/netinet/tcp_timer.c (revision a50d73d5782a351ad83e8d1f84d11720a12e70d3)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_rss.h"
40 
41 #include <sys/param.h>
42 #include <sys/kernel.h>
43 #include <sys/lock.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/protosw.h>
47 #include <sys/smp.h>
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/sysctl.h>
51 #include <sys/systm.h>
52 
53 #include <net/if.h>
54 #include <net/route.h>
55 #include <net/rss_config.h>
56 #include <net/vnet.h>
57 #include <net/netisr.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/in_kdtrace.h>
61 #include <netinet/in_pcb.h>
62 #include <netinet/in_rss.h>
63 #include <netinet/in_systm.h>
64 #ifdef INET6
65 #include <netinet6/in6_pcb.h>
66 #endif
67 #include <netinet/ip_var.h>
68 #include <netinet/tcp.h>
69 #include <netinet/tcp_fsm.h>
70 #include <netinet/tcp_timer.h>
71 #include <netinet/tcp_var.h>
72 #include <netinet/tcp_log_buf.h>
73 #include <netinet/tcp_seq.h>
74 #include <netinet/cc/cc.h>
75 #ifdef INET6
76 #include <netinet6/tcp6_var.h>
77 #endif
78 #include <netinet/tcpip.h>
79 
80 int    tcp_persmin;
81 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmin,
82     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
83     &tcp_persmin, 0, sysctl_msec_to_ticks, "I",
84     "minimum persistence interval");
85 
86 int    tcp_persmax;
87 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmax,
88     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
89     &tcp_persmax, 0, sysctl_msec_to_ticks, "I",
90     "maximum persistence interval");
91 
92 int	tcp_keepinit;
93 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit,
94     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
95     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I",
96     "time to establish connection");
97 
98 int	tcp_keepidle;
99 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle,
100     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
101     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I",
102     "time before keepalive probes begin");
103 
104 int	tcp_keepintvl;
105 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl,
106     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
107     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I",
108     "time between keepalive probes");
109 
110 int	tcp_delacktime;
111 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime,
112     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
113     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
114     "Time before a delayed ACK is sent");
115 
116 VNET_DEFINE(int, tcp_msl);
117 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl,
118     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_VNET,
119     &VNET_NAME(tcp_msl), 0, sysctl_msec_to_ticks, "I",
120     "Maximum segment lifetime");
121 
122 int	tcp_rexmit_initial;
123 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_initial,
124    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
125     &tcp_rexmit_initial, 0, sysctl_msec_to_ticks, "I",
126     "Initial Retransmission Timeout");
127 
128 int	tcp_rexmit_min;
129 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min,
130     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
131     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
132     "Minimum Retransmission Timeout");
133 
134 int	tcp_rexmit_slop;
135 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop,
136     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
137     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
138     "Retransmission Timer Slop");
139 
140 VNET_DEFINE(int, tcp_always_keepalive) = 1;
141 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_VNET|CTLFLAG_RW,
142     &VNET_NAME(tcp_always_keepalive) , 0,
143     "Assume SO_KEEPALIVE on all TCP connections");
144 
145 int    tcp_fast_finwait2_recycle = 0;
146 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
147     &tcp_fast_finwait2_recycle, 0,
148     "Recycle closed FIN_WAIT_2 connections faster");
149 
150 int    tcp_finwait2_timeout;
151 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout,
152     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
153     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I",
154     "FIN-WAIT2 timeout");
155 
156 int	tcp_keepcnt = TCPTV_KEEPCNT;
157 SYSCTL_INT(_net_inet_tcp, OID_AUTO, keepcnt, CTLFLAG_RW, &tcp_keepcnt, 0,
158     "Number of keepalive probes to send");
159 
160 	/* max idle probes */
161 int	tcp_maxpersistidle;
162 
163 int	tcp_rexmit_drop_options = 0;
164 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rexmit_drop_options, CTLFLAG_RW,
165     &tcp_rexmit_drop_options, 0,
166     "Drop TCP options from 3rd and later retransmitted SYN");
167 
168 int	tcp_maxunacktime = TCPTV_MAXUNACKTIME;
169 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, maxunacktime,
170     CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_NEEDGIANT,
171     &tcp_maxunacktime, 0, sysctl_msec_to_ticks, "I",
172     "Maximum time (in ms) that a session can linger without making progress");
173 
174 VNET_DEFINE(int, tcp_pmtud_blackhole_detect);
175 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pmtud_blackhole_detection,
176     CTLFLAG_RW|CTLFLAG_VNET,
177     &VNET_NAME(tcp_pmtud_blackhole_detect), 0,
178     "Path MTU Discovery Black Hole Detection Enabled");
179 
180 #ifdef INET
181 VNET_DEFINE(int, tcp_pmtud_blackhole_mss) = 1200;
182 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pmtud_blackhole_mss,
183     CTLFLAG_RW|CTLFLAG_VNET,
184     &VNET_NAME(tcp_pmtud_blackhole_mss), 0,
185     "Path MTU Discovery Black Hole Detection lowered MSS");
186 #endif
187 
188 #ifdef INET6
189 VNET_DEFINE(int, tcp_v6pmtud_blackhole_mss) = 1220;
190 SYSCTL_INT(_net_inet_tcp, OID_AUTO, v6pmtud_blackhole_mss,
191     CTLFLAG_RW|CTLFLAG_VNET,
192     &VNET_NAME(tcp_v6pmtud_blackhole_mss), 0,
193     "Path MTU Discovery IPv6 Black Hole Detection lowered MSS");
194 #endif
195 
196 #ifdef	RSS
197 static int	per_cpu_timers = 1;
198 #else
199 static int	per_cpu_timers = 0;
200 #endif
201 SYSCTL_INT(_net_inet_tcp, OID_AUTO, per_cpu_timers, CTLFLAG_RW,
202     &per_cpu_timers , 0, "run tcp timers on all cpus");
203 
204 /*
205  * Map the given inp to a CPU id.
206  *
207  * This queries RSS if it's compiled in, else it defaults to the current
208  * CPU ID.
209  */
210 inline int
211 inp_to_cpuid(struct inpcb *inp)
212 {
213 	u_int cpuid;
214 
215 	if (per_cpu_timers) {
216 #ifdef	RSS
217 		cpuid = rss_hash2cpuid(inp->inp_flowid, inp->inp_flowtype);
218 		if (cpuid == NETISR_CPUID_NONE)
219 			return (curcpu);	/* XXX */
220 		else
221 			return (cpuid);
222 #endif
223 		/*
224 		 * We don't have a flowid -> cpuid mapping, so cheat and
225 		 * just map unknown cpuids to curcpu.  Not the best, but
226 		 * apparently better than defaulting to swi 0.
227 		 */
228 		cpuid = inp->inp_flowid % (mp_maxid + 1);
229 		if (! CPU_ABSENT(cpuid))
230 			return (cpuid);
231 		return (curcpu);
232 	} else {
233 		return (0);
234 	}
235 }
236 
237 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
238     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
239 
240 int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
241 
242 /*
243  * TCP timer processing.
244  *
245  * Each connection has 5 timers associated with it, which can be scheduled
246  * simultaneously.  They all are serviced by one callout tcp_timer_enter().
247  * This function executes the next timer via tcp_timersw[] vector.  Each
248  * timer is supposed to return 'true' unless the connection was destroyed.
249  * In the former case tcp_timer_enter() will schedule callout for next timer.
250  */
251 
252 typedef bool tcp_timer_t(struct tcpcb *);
253 static tcp_timer_t tcp_timer_delack;
254 static tcp_timer_t tcp_timer_2msl;
255 static tcp_timer_t tcp_timer_keep;
256 static tcp_timer_t tcp_timer_persist;
257 static tcp_timer_t tcp_timer_rexmt;
258 
259 static tcp_timer_t * const tcp_timersw[TT_N] = {
260 	[TT_DELACK] = tcp_timer_delack,
261 	[TT_REXMT] = tcp_timer_rexmt,
262 	[TT_PERSIST] = tcp_timer_persist,
263 	[TT_KEEP] = tcp_timer_keep,
264 	[TT_2MSL] = tcp_timer_2msl,
265 };
266 
267 /*
268  * tcp_output_locked() s a timer specific variation of call to tcp_output(),
269  * see tcp_var.h for the rest.  It handles drop request from advanced stacks,
270  * but keeps tcpcb locked unless tcp_drop() destroyed it.
271  * Returns true if tcpcb is valid and locked.
272  */
273 static inline bool
274 tcp_output_locked(struct tcpcb *tp)
275 {
276 	int rv;
277 
278 	INP_WLOCK_ASSERT(tptoinpcb(tp));
279 
280 	if ((rv = tp->t_fb->tfb_tcp_output(tp)) < 0) {
281 		KASSERT(tp->t_fb->tfb_flags & TCP_FUNC_OUTPUT_CANDROP,
282 		    ("TCP stack %s requested tcp_drop(%p)",
283 		    tp->t_fb->tfb_tcp_block_name, tp));
284 		tp = tcp_drop(tp, rv);
285 	}
286 
287 	return (tp != NULL);
288 }
289 
290 static bool
291 tcp_timer_delack(struct tcpcb *tp)
292 {
293 	struct epoch_tracker et;
294 #if defined(INVARIANTS) || defined(VIMAGE)
295 	struct inpcb *inp = tptoinpcb(tp);
296 #endif
297 	bool rv;
298 
299 	INP_WLOCK_ASSERT(inp);
300 
301 	CURVNET_SET(inp->inp_vnet);
302 	tp->t_flags |= TF_ACKNOW;
303 	TCPSTAT_INC(tcps_delack);
304 	NET_EPOCH_ENTER(et);
305 	rv = tcp_output_locked(tp);
306 	NET_EPOCH_EXIT(et);
307 	CURVNET_RESTORE();
308 
309 	return (rv);
310 }
311 
312 static bool
313 tcp_timer_2msl(struct tcpcb *tp)
314 {
315 	struct inpcb *inp = tptoinpcb(tp);
316 	bool close = false;
317 
318 	INP_WLOCK_ASSERT(inp);
319 
320 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
321 	CURVNET_SET(inp->inp_vnet);
322 	tcp_log_end_status(tp, TCP_EI_STATUS_2MSL);
323 	tcp_free_sackholes(tp);
324 	/*
325 	 * 2 MSL timeout in shutdown went off.  If we're closed but
326 	 * still waiting for peer to close and connection has been idle
327 	 * too long delete connection control block.  Otherwise, check
328 	 * again in a bit.
329 	 *
330 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
331 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
332 	 * Ignore fact that there were recent incoming segments.
333 	 *
334 	 * XXXGL: check if inp_socket shall always be !NULL here?
335 	 */
336 	if (tp->t_state == TCPS_TIME_WAIT) {
337 		close = true;
338 	} else if (tp->t_state == TCPS_FIN_WAIT_2 &&
339 	    tcp_fast_finwait2_recycle && inp->inp_socket &&
340 	    (inp->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
341 		TCPSTAT_INC(tcps_finwait2_drops);
342 		close = true;
343 	} else {
344 		if (ticks - tp->t_rcvtime <= TP_MAXIDLE(tp))
345 			tcp_timer_activate(tp, TT_2MSL, TP_KEEPINTVL(tp));
346 		else
347 			close = true;
348 	}
349 	if (close) {
350 		struct epoch_tracker et;
351 
352 		NET_EPOCH_ENTER(et);
353 		tp = tcp_close(tp);
354 		NET_EPOCH_EXIT(et);
355 	}
356 	CURVNET_RESTORE();
357 
358 	return (tp != NULL);
359 }
360 
361 static bool
362 tcp_timer_keep(struct tcpcb *tp)
363 {
364 	struct epoch_tracker et;
365 	struct inpcb *inp = tptoinpcb(tp);
366 	struct tcptemp *t_template;
367 
368 	INP_WLOCK_ASSERT(inp);
369 
370 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
371 	CURVNET_SET(inp->inp_vnet);
372 	/*
373 	 * Because we don't regularly reset the keepalive callout in
374 	 * the ESTABLISHED state, it may be that we don't actually need
375 	 * to send a keepalive yet. If that occurs, schedule another
376 	 * call for the next time the keepalive timer might expire.
377 	 */
378 	if (TCPS_HAVEESTABLISHED(tp->t_state)) {
379 		u_int idletime;
380 
381 		idletime = ticks - tp->t_rcvtime;
382 		if (idletime < TP_KEEPIDLE(tp)) {
383 			tcp_timer_activate(tp, TT_KEEP,
384 			    TP_KEEPIDLE(tp) - idletime);
385 			CURVNET_RESTORE();
386 			return (true);
387 		}
388 	}
389 
390 	/*
391 	 * Keep-alive timer went off; send something
392 	 * or drop connection if idle for too long.
393 	 */
394 	TCPSTAT_INC(tcps_keeptimeo);
395 	if (tp->t_state < TCPS_ESTABLISHED)
396 		goto dropit;
397 	if ((V_tcp_always_keepalive ||
398 	    inp->inp_socket->so_options & SO_KEEPALIVE) &&
399 	    tp->t_state <= TCPS_CLOSING) {
400 		if (ticks - tp->t_rcvtime >= TP_KEEPIDLE(tp) + TP_MAXIDLE(tp))
401 			goto dropit;
402 		/*
403 		 * Send a packet designed to force a response
404 		 * if the peer is up and reachable:
405 		 * either an ACK if the connection is still alive,
406 		 * or an RST if the peer has closed the connection
407 		 * due to timeout or reboot.
408 		 * Using sequence number tp->snd_una-1
409 		 * causes the transmitted zero-length segment
410 		 * to lie outside the receive window;
411 		 * by the protocol spec, this requires the
412 		 * correspondent TCP to respond.
413 		 */
414 		TCPSTAT_INC(tcps_keepprobe);
415 		t_template = tcpip_maketemplate(inp);
416 		if (t_template) {
417 			NET_EPOCH_ENTER(et);
418 			tcp_respond(tp, t_template->tt_ipgen,
419 				    &t_template->tt_t, (struct mbuf *)NULL,
420 				    tp->rcv_nxt, tp->snd_una - 1, 0);
421 			NET_EPOCH_EXIT(et);
422 			free(t_template, M_TEMP);
423 		}
424 		tcp_timer_activate(tp, TT_KEEP, TP_KEEPINTVL(tp));
425 	} else
426 		tcp_timer_activate(tp, TT_KEEP, TP_KEEPIDLE(tp));
427 
428 	CURVNET_RESTORE();
429 	return (true);
430 
431 dropit:
432 	TCPSTAT_INC(tcps_keepdrops);
433 	NET_EPOCH_ENTER(et);
434 	tcp_log_end_status(tp, TCP_EI_STATUS_KEEP_MAX);
435 	tp = tcp_drop(tp, ETIMEDOUT);
436 	NET_EPOCH_EXIT(et);
437 	CURVNET_RESTORE();
438 
439 	return (tp != NULL);
440 }
441 
442 /*
443  * Has this session exceeded the maximum time without seeing a substantive
444  * acknowledgement? If so, return true; otherwise false.
445  */
446 static bool
447 tcp_maxunacktime_check(struct tcpcb *tp)
448 {
449 
450 	/* Are we tracking this timer for this session? */
451 	if (TP_MAXUNACKTIME(tp) == 0)
452 		return false;
453 
454 	/* Do we have a current measurement. */
455 	if (tp->t_acktime == 0)
456 		return false;
457 
458 	/* Are we within the acceptable range? */
459 	if (TSTMP_GT(TP_MAXUNACKTIME(tp) + tp->t_acktime, (u_int)ticks))
460 		return false;
461 
462 	/* We exceeded the timer. */
463 	TCPSTAT_INC(tcps_progdrops);
464 	return true;
465 }
466 
467 static bool
468 tcp_timer_persist(struct tcpcb *tp)
469 {
470 	struct epoch_tracker et;
471 #if defined(INVARIANTS) || defined(VIMAGE)
472 	struct inpcb *inp = tptoinpcb(tp);
473 #endif
474 	bool progdrop, rv;
475 
476 	INP_WLOCK_ASSERT(inp);
477 
478 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
479 	CURVNET_SET(inp->inp_vnet);
480 	/*
481 	 * Persistence timer into zero window.
482 	 * Force a byte to be output, if possible.
483 	 */
484 	TCPSTAT_INC(tcps_persisttimeo);
485 	/*
486 	 * Hack: if the peer is dead/unreachable, we do not
487 	 * time out if the window is closed.  After a full
488 	 * backoff, drop the connection if the idle time
489 	 * (no responses to probes) reaches the maximum
490 	 * backoff that we would use if retransmitting.
491 	 * Also, drop the connection if we haven't been making
492 	 * progress.
493 	 */
494 	progdrop = tcp_maxunacktime_check(tp);
495 	if (progdrop || (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
496 	    (ticks - tp->t_rcvtime >= tcp_maxpersistidle ||
497 	     ticks - tp->t_rcvtime >= TCP_REXMTVAL(tp) * tcp_totbackoff))) {
498 		if (!progdrop)
499 			TCPSTAT_INC(tcps_persistdrop);
500 		tcp_log_end_status(tp, TCP_EI_STATUS_PERSIST_MAX);
501 		goto dropit;
502 	}
503 	/*
504 	 * If the user has closed the socket then drop a persisting
505 	 * connection after a much reduced timeout.
506 	 */
507 	if (tp->t_state > TCPS_CLOSE_WAIT &&
508 	    (ticks - tp->t_rcvtime) >= TCPTV_PERSMAX) {
509 		TCPSTAT_INC(tcps_persistdrop);
510 		tcp_log_end_status(tp, TCP_EI_STATUS_PERSIST_MAX);
511 		goto dropit;
512 	}
513 	tcp_setpersist(tp);
514 	tp->t_flags |= TF_FORCEDATA;
515 	NET_EPOCH_ENTER(et);
516 	if ((rv = tcp_output_locked(tp)))
517 		tp->t_flags &= ~TF_FORCEDATA;
518 	NET_EPOCH_EXIT(et);
519 	CURVNET_RESTORE();
520 
521 	return (rv);
522 
523 dropit:
524 	NET_EPOCH_ENTER(et);
525 	tp = tcp_drop(tp, ETIMEDOUT);
526 	NET_EPOCH_EXIT(et);
527 	CURVNET_RESTORE();
528 
529 	return (tp != NULL);
530 }
531 
532 static bool
533 tcp_timer_rexmt(struct tcpcb *tp)
534 {
535 	struct epoch_tracker et;
536 	struct inpcb *inp = tptoinpcb(tp);
537 	int rexmt;
538 	bool isipv6, rv;
539 
540 	INP_WLOCK_ASSERT(inp);
541 
542 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
543 	CURVNET_SET(inp->inp_vnet);
544 	tcp_free_sackholes(tp);
545 	if (tp->t_fb->tfb_tcp_rexmit_tmr) {
546 		/* The stack has a timer action too. */
547 		(*tp->t_fb->tfb_tcp_rexmit_tmr)(tp);
548 	}
549 	/*
550 	 * Retransmission timer went off.  Message has not
551 	 * been acked within retransmit interval.  Back off
552 	 * to a longer retransmit interval and retransmit one segment.
553 	 *
554 	 * If we've either exceeded the maximum number of retransmissions,
555 	 * or we've gone long enough without making progress, then drop
556 	 * the session.
557 	 */
558 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT || tcp_maxunacktime_check(tp)) {
559 		if (tp->t_rxtshift > TCP_MAXRXTSHIFT)
560 			TCPSTAT_INC(tcps_timeoutdrop);
561 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
562 		tcp_log_end_status(tp, TCP_EI_STATUS_RETRAN);
563 		NET_EPOCH_ENTER(et);
564 		tp = tcp_drop(tp, ETIMEDOUT);
565 		NET_EPOCH_EXIT(et);
566 		CURVNET_RESTORE();
567 
568 		return (tp != NULL);
569 	}
570 	if (tp->t_state == TCPS_SYN_SENT) {
571 		/*
572 		 * If the SYN was retransmitted, indicate CWND to be
573 		 * limited to 1 segment in cc_conn_init().
574 		 */
575 		tp->snd_cwnd = 1;
576 	} else if (tp->t_rxtshift == 1) {
577 		/*
578 		 * first retransmit; record ssthresh and cwnd so they can
579 		 * be recovered if this turns out to be a "bad" retransmit.
580 		 * A retransmit is considered "bad" if an ACK for this
581 		 * segment is received within RTT/2 interval; the assumption
582 		 * here is that the ACK was already in flight.  See
583 		 * "On Estimating End-to-End Network Path Properties" by
584 		 * Allman and Paxson for more details.
585 		 */
586 		tp->snd_cwnd_prev = tp->snd_cwnd;
587 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
588 		tp->snd_recover_prev = tp->snd_recover;
589 		if (IN_FASTRECOVERY(tp->t_flags))
590 			tp->t_flags |= TF_WASFRECOVERY;
591 		else
592 			tp->t_flags &= ~TF_WASFRECOVERY;
593 		if (IN_CONGRECOVERY(tp->t_flags))
594 			tp->t_flags |= TF_WASCRECOVERY;
595 		else
596 			tp->t_flags &= ~TF_WASCRECOVERY;
597 		if ((tp->t_flags & TF_RCVD_TSTMP) == 0)
598 			tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
599 		/* In the event that we've negotiated timestamps
600 		 * badrxtwin will be set to the value that we set
601 		 * the retransmitted packet's to_tsval to by tcp_output
602 		 */
603 		tp->t_flags |= TF_PREVVALID;
604 	} else
605 		tp->t_flags &= ~TF_PREVVALID;
606 	TCPSTAT_INC(tcps_rexmttimeo);
607 	if ((tp->t_state == TCPS_SYN_SENT) ||
608 	    (tp->t_state == TCPS_SYN_RECEIVED))
609 		rexmt = tcp_rexmit_initial * tcp_backoff[tp->t_rxtshift];
610 	else
611 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
612 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
613 		      tp->t_rttmin, TCPTV_REXMTMAX);
614 
615 	/*
616 	 * We enter the path for PLMTUD if connection is established or, if
617 	 * connection is FIN_WAIT_1 status, reason for the last is that if
618 	 * amount of data we send is very small, we could send it in couple of
619 	 * packets and process straight to FIN. In that case we won't catch
620 	 * ESTABLISHED state.
621 	 */
622 #ifdef INET6
623 	isipv6 = (inp->inp_vflag & INP_IPV6) ? true : false;
624 #else
625 	isipv6 = false;
626 #endif
627 	if (((V_tcp_pmtud_blackhole_detect == 1) ||
628 	    (V_tcp_pmtud_blackhole_detect == 2 && !isipv6) ||
629 	    (V_tcp_pmtud_blackhole_detect == 3 && isipv6)) &&
630 	    ((tp->t_state == TCPS_ESTABLISHED) ||
631 	    (tp->t_state == TCPS_FIN_WAIT_1))) {
632 		if (tp->t_rxtshift == 1) {
633 			/*
634 			 * We enter blackhole detection after the first
635 			 * unsuccessful timer based retransmission.
636 			 * Then we reduce up to two times the MSS, each
637 			 * candidate giving two tries of retransmissions.
638 			 * But we give a candidate only two tries, if it
639 			 * actually reduces the MSS.
640 			 */
641 			tp->t_blackhole_enter = 2;
642 			tp->t_blackhole_exit = tp->t_blackhole_enter;
643 			if (isipv6) {
644 #ifdef INET6
645 				if (tp->t_maxseg > V_tcp_v6pmtud_blackhole_mss)
646 					tp->t_blackhole_exit += 2;
647 				if (tp->t_maxseg > V_tcp_v6mssdflt &&
648 				    V_tcp_v6pmtud_blackhole_mss > V_tcp_v6mssdflt)
649 					tp->t_blackhole_exit += 2;
650 #endif
651 			} else {
652 #ifdef INET
653 				if (tp->t_maxseg > V_tcp_pmtud_blackhole_mss)
654 					tp->t_blackhole_exit += 2;
655 				if (tp->t_maxseg > V_tcp_mssdflt &&
656 				    V_tcp_pmtud_blackhole_mss > V_tcp_mssdflt)
657 					tp->t_blackhole_exit += 2;
658 #endif
659 			}
660 		}
661 		if (((tp->t_flags2 & (TF2_PLPMTU_PMTUD|TF2_PLPMTU_MAXSEGSNT)) ==
662 		    (TF2_PLPMTU_PMTUD|TF2_PLPMTU_MAXSEGSNT)) &&
663 		    (tp->t_rxtshift >= tp->t_blackhole_enter &&
664 		    tp->t_rxtshift < tp->t_blackhole_exit &&
665 		    (tp->t_rxtshift - tp->t_blackhole_enter) % 2 == 0)) {
666 			/*
667 			 * Enter Path MTU Black-hole Detection mechanism:
668 			 * - Disable Path MTU Discovery (IP "DF" bit).
669 			 * - Reduce MTU to lower value than what we
670 			 *   negotiated with peer.
671 			 */
672 			if ((tp->t_flags2 & TF2_PLPMTU_BLACKHOLE) == 0) {
673 				/* Record that we may have found a black hole. */
674 				tp->t_flags2 |= TF2_PLPMTU_BLACKHOLE;
675 				/* Keep track of previous MSS. */
676 				tp->t_pmtud_saved_maxseg = tp->t_maxseg;
677 			}
678 
679 			/*
680 			 * Reduce the MSS to blackhole value or to the default
681 			 * in an attempt to retransmit.
682 			 */
683 #ifdef INET6
684 			if (isipv6 &&
685 			    tp->t_maxseg > V_tcp_v6pmtud_blackhole_mss &&
686 			    V_tcp_v6pmtud_blackhole_mss > V_tcp_v6mssdflt) {
687 				/* Use the sysctl tuneable blackhole MSS. */
688 				tp->t_maxseg = V_tcp_v6pmtud_blackhole_mss;
689 				TCPSTAT_INC(tcps_pmtud_blackhole_activated);
690 			} else if (isipv6) {
691 				/* Use the default MSS. */
692 				tp->t_maxseg = V_tcp_v6mssdflt;
693 				/*
694 				 * Disable Path MTU Discovery when we switch to
695 				 * minmss.
696 				 */
697 				tp->t_flags2 &= ~TF2_PLPMTU_PMTUD;
698 				TCPSTAT_INC(tcps_pmtud_blackhole_activated_min_mss);
699 			}
700 #endif
701 #if defined(INET6) && defined(INET)
702 			else
703 #endif
704 #ifdef INET
705 			if (tp->t_maxseg > V_tcp_pmtud_blackhole_mss &&
706 			    V_tcp_pmtud_blackhole_mss > V_tcp_mssdflt) {
707 				/* Use the sysctl tuneable blackhole MSS. */
708 				tp->t_maxseg = V_tcp_pmtud_blackhole_mss;
709 				TCPSTAT_INC(tcps_pmtud_blackhole_activated);
710 			} else {
711 				/* Use the default MSS. */
712 				tp->t_maxseg = V_tcp_mssdflt;
713 				/*
714 				 * Disable Path MTU Discovery when we switch to
715 				 * minmss.
716 				 */
717 				tp->t_flags2 &= ~TF2_PLPMTU_PMTUD;
718 				TCPSTAT_INC(tcps_pmtud_blackhole_activated_min_mss);
719 			}
720 #endif
721 			/*
722 			 * Reset the slow-start flight size
723 			 * as it may depend on the new MSS.
724 			 */
725 			if (CC_ALGO(tp)->conn_init != NULL)
726 				CC_ALGO(tp)->conn_init(&tp->t_ccv);
727 		} else {
728 			/*
729 			 * If further retransmissions are still unsuccessful
730 			 * with a lowered MTU, maybe this isn't a blackhole and
731 			 * we restore the previous MSS and blackhole detection
732 			 * flags.
733 			 */
734 			if ((tp->t_flags2 & TF2_PLPMTU_BLACKHOLE) &&
735 			    (tp->t_rxtshift >= tp->t_blackhole_exit)) {
736 				tp->t_flags2 |= TF2_PLPMTU_PMTUD;
737 				tp->t_flags2 &= ~TF2_PLPMTU_BLACKHOLE;
738 				tp->t_maxseg = tp->t_pmtud_saved_maxseg;
739 				TCPSTAT_INC(tcps_pmtud_blackhole_failed);
740 				/*
741 				 * Reset the slow-start flight size as it
742 				 * may depend on the new MSS.
743 				 */
744 				if (CC_ALGO(tp)->conn_init != NULL)
745 					CC_ALGO(tp)->conn_init(&tp->t_ccv);
746 			}
747 		}
748 	}
749 
750 	/*
751 	 * Disable RFC1323 and SACK if we haven't got any response to
752 	 * our third SYN to work-around some broken terminal servers
753 	 * (most of which have hopefully been retired) that have bad VJ
754 	 * header compression code which trashes TCP segments containing
755 	 * unknown-to-them TCP options.
756 	 */
757 	if (tcp_rexmit_drop_options && (tp->t_state == TCPS_SYN_SENT) &&
758 	    (tp->t_rxtshift == 3))
759 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP|TF_SACK_PERMIT);
760 	/*
761 	 * If we backed off this far, notify the L3 protocol that we're having
762 	 * connection problems.
763 	 */
764 	if (tp->t_rxtshift > TCP_RTT_INVALIDATE) {
765 #ifdef INET6
766 		if ((inp->inp_vflag & INP_IPV6) != 0)
767 			in6_losing(inp);
768 		else
769 #endif
770 			in_losing(inp);
771 	}
772 	tp->snd_nxt = tp->snd_una;
773 	tp->snd_recover = tp->snd_max;
774 	/*
775 	 * Force a segment to be sent.
776 	 */
777 	tp->t_flags |= TF_ACKNOW;
778 	/*
779 	 * If timing a segment in this window, stop the timer.
780 	 */
781 	tp->t_rtttime = 0;
782 
783 	cc_cong_signal(tp, NULL, CC_RTO);
784 	NET_EPOCH_ENTER(et);
785 	rv = tcp_output_locked(tp);
786 	NET_EPOCH_EXIT(et);
787 	CURVNET_RESTORE();
788 
789 	return (rv);
790 }
791 
792 static void
793 tcp_bblog_timer(struct tcpcb *tp, tt_which which, tt_what what, uint32_t ticks)
794 {
795 	struct tcp_log_buffer *lgb;
796 	uint64_t ms;
797 
798 	INP_WLOCK_ASSERT(tptoinpcb(tp));
799 	if (tcp_bblogging_on(tp))
800 		lgb = tcp_log_event(tp, NULL, NULL, NULL, TCP_LOG_RTO, 0, 0,
801 		    NULL, false, NULL, NULL, 0, NULL);
802 	else
803 		lgb = NULL;
804 	if (lgb != NULL) {
805 		lgb->tlb_flex1 = (what << 8) | which;
806 		if (what == TT_STARTING) {
807 			/* Convert ticks to ms and store it in tlb_flex2. */
808 			if (hz == 1000)
809 				lgb->tlb_flex2 = ticks;
810 			else {
811 				ms = (((uint64_t)ticks * 1000) + (hz - 1)) / hz;
812 				if (ms > UINT32_MAX)
813 					lgb->tlb_flex2 = UINT32_MAX;
814 				else
815 					lgb->tlb_flex2 = (uint32_t)ms;
816 			}
817 		}
818 	}
819 }
820 
821 static inline tt_which
822 tcp_timer_next(struct tcpcb *tp, sbintime_t *precision)
823 {
824 	tt_which i, rv;
825 	sbintime_t after, before;
826 
827 	for (i = 0, rv = TT_N, after = before = SBT_MAX; i < TT_N; i++) {
828 		if (tp->t_timers[i] < after) {
829 			after = tp->t_timers[i];
830 			rv = i;
831 		}
832 		before = MIN(before, tp->t_timers[i] + tp->t_precisions[i]);
833 	}
834 	if (precision != NULL)
835 		*precision = before - after;
836 
837 	return (rv);
838 }
839 
840 static void
841 tcp_timer_enter(void *xtp)
842 {
843 	struct tcpcb *tp = xtp;
844 	struct inpcb *inp = tptoinpcb(tp);
845 	sbintime_t precision;
846 	tt_which which;
847 	bool tp_valid;
848 
849 	INP_WLOCK_ASSERT(inp);
850 	MPASS((curthread->td_pflags & TDP_INTCPCALLOUT) == 0);
851 
852 	curthread->td_pflags |= TDP_INTCPCALLOUT;
853 
854 	which = tcp_timer_next(tp, NULL);
855 	MPASS(which < TT_N);
856 	tp->t_timers[which] = SBT_MAX;
857 	tp->t_precisions[which] = 0;
858 
859 	tcp_bblog_timer(tp, which, TT_PROCESSING, 0);
860 	tp_valid = tcp_timersw[which](tp);
861 	if (tp_valid) {
862 		tcp_bblog_timer(tp, which, TT_PROCESSED, 0);
863 		if ((which = tcp_timer_next(tp, &precision)) != TT_N) {
864 			callout_reset_sbt_on(&tp->t_callout,
865 			    tp->t_timers[which], precision, tcp_timer_enter,
866 			    tp, inp_to_cpuid(inp), C_ABSOLUTE);
867 		}
868 		INP_WUNLOCK(inp);
869 	}
870 
871 	curthread->td_pflags &= ~TDP_INTCPCALLOUT;
872 }
873 
874 /*
875  * Activate or stop (delta == 0) a TCP timer.
876  */
877 void
878 tcp_timer_activate(struct tcpcb *tp, tt_which which, u_int delta)
879 {
880 	struct inpcb *inp = tptoinpcb(tp);
881 	sbintime_t precision;
882 	tt_what what;
883 
884 #ifdef TCP_OFFLOAD
885 	if (tp->t_flags & TF_TOE)
886 		return;
887 #endif
888 
889 	INP_WLOCK_ASSERT(inp);
890 
891 	if (delta > 0) {
892 		what = TT_STARTING;
893 		callout_when(tick_sbt * delta, 0, C_HARDCLOCK,
894 		    &tp->t_timers[which], &tp->t_precisions[which]);
895 	} else {
896 		what = TT_STOPPING;
897 		tp->t_timers[which] = SBT_MAX;
898 	}
899 	tcp_bblog_timer(tp, which, what, delta);
900 
901 	if ((which = tcp_timer_next(tp, &precision)) != TT_N)
902 		callout_reset_sbt_on(&tp->t_callout, tp->t_timers[which],
903 		    precision, tcp_timer_enter, tp, inp_to_cpuid(inp),
904 		    C_ABSOLUTE);
905 	else
906 		callout_stop(&tp->t_callout);
907 }
908 
909 bool
910 tcp_timer_active(struct tcpcb *tp, tt_which which)
911 {
912 
913 	INP_WLOCK_ASSERT(tptoinpcb(tp));
914 
915 	return (tp->t_timers[which] != SBT_MAX);
916 }
917 
918 /*
919  * Stop all timers associated with tcpcb.
920  *
921  * Called only on tcpcb destruction.  The tcpcb shall already be dropped from
922  * the pcb lookup database and socket is not losing the last reference.
923  *
924  * XXXGL: unfortunately our callout(9) is not able to fully stop a locked
925  * callout even when only two threads are involved: the callout itself and the
926  * thread that does callout_stop().  See where softclock_call_cc() swaps the
927  * callwheel lock to callout lock and then checks cc_exec_cancel().  This is
928  * the race window.  If it happens, the tcp_timer_enter() won't be executed,
929  * however pcb lock will be locked and released, hence we can't free memory.
930  * Until callout(9) is improved, just keep retrying.  In my profiling I've seen
931  * such event happening less than 1 time per hour with 20-30 Gbit/s of traffic.
932  */
933 void
934 tcp_timer_stop(struct tcpcb *tp)
935 {
936 	struct inpcb *inp = tptoinpcb(tp);
937 
938 	INP_WLOCK_ASSERT(inp);
939 
940 	if (curthread->td_pflags & TDP_INTCPCALLOUT) {
941 		int stopped __diagused;
942 
943 		stopped = callout_stop(&tp->t_callout);
944 		MPASS(stopped == 0);
945 	} else while(__predict_false(callout_stop(&tp->t_callout) == 0)) {
946 		INP_WUNLOCK(inp);
947 		kern_yield(PRI_UNCHANGED);
948 		INP_WLOCK(inp);
949 	}
950 }
951