xref: /freebsd/sys/netinet/tcp_timer.c (revision c697fb7f7cc9bedc5beee44d35b771c4e87b335a)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_tcpdebug.h"
40 #include "opt_rss.h"
41 
42 #include <sys/param.h>
43 #include <sys/kernel.h>
44 #include <sys/lock.h>
45 #include <sys/mbuf.h>
46 #include <sys/mutex.h>
47 #include <sys/protosw.h>
48 #include <sys/smp.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 
54 #include <net/if.h>
55 #include <net/route.h>
56 #include <net/rss_config.h>
57 #include <net/vnet.h>
58 #include <net/netisr.h>
59 
60 #include <netinet/in.h>
61 #include <netinet/in_kdtrace.h>
62 #include <netinet/in_pcb.h>
63 #include <netinet/in_rss.h>
64 #include <netinet/in_systm.h>
65 #ifdef INET6
66 #include <netinet6/in6_pcb.h>
67 #endif
68 #include <netinet/ip_var.h>
69 #include <netinet/tcp.h>
70 #include <netinet/tcp_fsm.h>
71 #include <netinet/tcp_log_buf.h>
72 #include <netinet/tcp_timer.h>
73 #include <netinet/tcp_var.h>
74 #include <netinet/tcp_seq.h>
75 #include <netinet/cc/cc.h>
76 #ifdef INET6
77 #include <netinet6/tcp6_var.h>
78 #endif
79 #include <netinet/tcpip.h>
80 #ifdef TCPDEBUG
81 #include <netinet/tcp_debug.h>
82 #endif
83 
84 int    tcp_persmin;
85 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmin,
86     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
87     &tcp_persmin, 0, sysctl_msec_to_ticks, "I",
88     "minimum persistence interval");
89 
90 int    tcp_persmax;
91 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmax,
92     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
93     &tcp_persmax, 0, sysctl_msec_to_ticks, "I",
94     "maximum persistence interval");
95 
96 int	tcp_keepinit;
97 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit,
98     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
99     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I",
100     "time to establish connection");
101 
102 int	tcp_keepidle;
103 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle,
104     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
105     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I",
106     "time before keepalive probes begin");
107 
108 int	tcp_keepintvl;
109 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl,
110     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
111     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I",
112     "time between keepalive probes");
113 
114 int	tcp_delacktime;
115 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime,
116     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
117     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
118     "Time before a delayed ACK is sent");
119 
120 int	tcp_msl;
121 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl,
122     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
123     &tcp_msl, 0, sysctl_msec_to_ticks, "I",
124     "Maximum segment lifetime");
125 
126 int	tcp_rexmit_initial;
127 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_initial,
128    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
129     &tcp_rexmit_initial, 0, sysctl_msec_to_ticks, "I",
130     "Initial Retransmission Timeout");
131 
132 int	tcp_rexmit_min;
133 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min,
134     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
135     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
136     "Minimum Retransmission Timeout");
137 
138 int	tcp_rexmit_slop;
139 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop,
140     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
141     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
142     "Retransmission Timer Slop");
143 
144 VNET_DEFINE(int, tcp_always_keepalive) = 1;
145 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_VNET|CTLFLAG_RW,
146     &VNET_NAME(tcp_always_keepalive) , 0,
147     "Assume SO_KEEPALIVE on all TCP connections");
148 
149 int    tcp_fast_finwait2_recycle = 0;
150 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
151     &tcp_fast_finwait2_recycle, 0,
152     "Recycle closed FIN_WAIT_2 connections faster");
153 
154 int    tcp_finwait2_timeout;
155 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout,
156     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
157     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I",
158     "FIN-WAIT2 timeout");
159 
160 int	tcp_keepcnt = TCPTV_KEEPCNT;
161 SYSCTL_INT(_net_inet_tcp, OID_AUTO, keepcnt, CTLFLAG_RW, &tcp_keepcnt, 0,
162     "Number of keepalive probes to send");
163 
164 	/* max idle probes */
165 int	tcp_maxpersistidle;
166 
167 int	tcp_rexmit_drop_options = 0;
168 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rexmit_drop_options, CTLFLAG_RW,
169     &tcp_rexmit_drop_options, 0,
170     "Drop TCP options from 3rd and later retransmitted SYN");
171 
172 VNET_DEFINE(int, tcp_pmtud_blackhole_detect);
173 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pmtud_blackhole_detection,
174     CTLFLAG_RW|CTLFLAG_VNET,
175     &VNET_NAME(tcp_pmtud_blackhole_detect), 0,
176     "Path MTU Discovery Black Hole Detection Enabled");
177 
178 #ifdef INET
179 VNET_DEFINE(int, tcp_pmtud_blackhole_mss) = 1200;
180 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pmtud_blackhole_mss,
181     CTLFLAG_RW|CTLFLAG_VNET,
182     &VNET_NAME(tcp_pmtud_blackhole_mss), 0,
183     "Path MTU Discovery Black Hole Detection lowered MSS");
184 #endif
185 
186 #ifdef INET6
187 VNET_DEFINE(int, tcp_v6pmtud_blackhole_mss) = 1220;
188 SYSCTL_INT(_net_inet_tcp, OID_AUTO, v6pmtud_blackhole_mss,
189     CTLFLAG_RW|CTLFLAG_VNET,
190     &VNET_NAME(tcp_v6pmtud_blackhole_mss), 0,
191     "Path MTU Discovery IPv6 Black Hole Detection lowered MSS");
192 #endif
193 
194 #ifdef	RSS
195 static int	per_cpu_timers = 1;
196 #else
197 static int	per_cpu_timers = 0;
198 #endif
199 SYSCTL_INT(_net_inet_tcp, OID_AUTO, per_cpu_timers, CTLFLAG_RW,
200     &per_cpu_timers , 0, "run tcp timers on all cpus");
201 
202 /*
203  * Map the given inp to a CPU id.
204  *
205  * This queries RSS if it's compiled in, else it defaults to the current
206  * CPU ID.
207  */
208 inline int
209 inp_to_cpuid(struct inpcb *inp)
210 {
211 	u_int cpuid;
212 
213 #ifdef	RSS
214 	if (per_cpu_timers) {
215 		cpuid = rss_hash2cpuid(inp->inp_flowid, inp->inp_flowtype);
216 		if (cpuid == NETISR_CPUID_NONE)
217 			return (curcpu);	/* XXX */
218 		else
219 			return (cpuid);
220 	}
221 #else
222 	/* Legacy, pre-RSS behaviour */
223 	if (per_cpu_timers) {
224 		/*
225 		 * We don't have a flowid -> cpuid mapping, so cheat and
226 		 * just map unknown cpuids to curcpu.  Not the best, but
227 		 * apparently better than defaulting to swi 0.
228 		 */
229 		cpuid = inp->inp_flowid % (mp_maxid + 1);
230 		if (! CPU_ABSENT(cpuid))
231 			return (cpuid);
232 		return (curcpu);
233 	}
234 #endif
235 	/* Default for RSS and non-RSS - cpuid 0 */
236 	else {
237 		return (0);
238 	}
239 }
240 
241 /*
242  * Tcp protocol timeout routine called every 500 ms.
243  * Updates timestamps used for TCP
244  * causes finite state machine actions if timers expire.
245  */
246 void
247 tcp_slowtimo(void)
248 {
249 	VNET_ITERATOR_DECL(vnet_iter);
250 
251 	VNET_LIST_RLOCK_NOSLEEP();
252 	VNET_FOREACH(vnet_iter) {
253 		CURVNET_SET(vnet_iter);
254 		(void) tcp_tw_2msl_scan(0);
255 		CURVNET_RESTORE();
256 	}
257 	VNET_LIST_RUNLOCK_NOSLEEP();
258 }
259 
260 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
261     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
262 
263 int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
264 
265 /*
266  * TCP timer processing.
267  */
268 
269 void
270 tcp_timer_delack(void *xtp)
271 {
272 	struct epoch_tracker et;
273 	struct tcpcb *tp = xtp;
274 	struct inpcb *inp;
275 	CURVNET_SET(tp->t_vnet);
276 
277 	inp = tp->t_inpcb;
278 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL", __func__, tp));
279 	INP_WLOCK(inp);
280 	if (callout_pending(&tp->t_timers->tt_delack) ||
281 	    !callout_active(&tp->t_timers->tt_delack)) {
282 		INP_WUNLOCK(inp);
283 		CURVNET_RESTORE();
284 		return;
285 	}
286 	callout_deactivate(&tp->t_timers->tt_delack);
287 	if ((inp->inp_flags & INP_DROPPED) != 0) {
288 		INP_WUNLOCK(inp);
289 		CURVNET_RESTORE();
290 		return;
291 	}
292 	tp->t_flags |= TF_ACKNOW;
293 	TCPSTAT_INC(tcps_delack);
294 	NET_EPOCH_ENTER(et);
295 	(void) tp->t_fb->tfb_tcp_output(tp);
296 	INP_WUNLOCK(inp);
297 	NET_EPOCH_EXIT(et);
298 	CURVNET_RESTORE();
299 }
300 
301 void
302 tcp_inpinfo_lock_del(struct inpcb *inp, struct tcpcb *tp)
303 {
304 	if (inp && tp != NULL)
305 		INP_WUNLOCK(inp);
306 }
307 
308 void
309 tcp_timer_2msl(void *xtp)
310 {
311 	struct tcpcb *tp = xtp;
312 	struct inpcb *inp;
313 	struct epoch_tracker et;
314 	CURVNET_SET(tp->t_vnet);
315 #ifdef TCPDEBUG
316 	int ostate;
317 
318 	ostate = tp->t_state;
319 #endif
320 	inp = tp->t_inpcb;
321 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL", __func__, tp));
322 	INP_WLOCK(inp);
323 	tcp_free_sackholes(tp);
324 	if (callout_pending(&tp->t_timers->tt_2msl) ||
325 	    !callout_active(&tp->t_timers->tt_2msl)) {
326 		INP_WUNLOCK(tp->t_inpcb);
327 		CURVNET_RESTORE();
328 		return;
329 	}
330 	callout_deactivate(&tp->t_timers->tt_2msl);
331 	if ((inp->inp_flags & INP_DROPPED) != 0) {
332 		INP_WUNLOCK(inp);
333 		CURVNET_RESTORE();
334 		return;
335 	}
336 	KASSERT((tp->t_timers->tt_flags & TT_STOPPED) == 0,
337 		("%s: tp %p tcpcb can't be stopped here", __func__, tp));
338 	/*
339 	 * 2 MSL timeout in shutdown went off.  If we're closed but
340 	 * still waiting for peer to close and connection has been idle
341 	 * too long delete connection control block.  Otherwise, check
342 	 * again in a bit.
343 	 *
344 	 * If in TIME_WAIT state just ignore as this timeout is handled in
345 	 * tcp_tw_2msl_scan().
346 	 *
347 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
348 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
349 	 * Ignore fact that there were recent incoming segments.
350 	 */
351 	if ((inp->inp_flags & INP_TIMEWAIT) != 0) {
352 		INP_WUNLOCK(inp);
353 		CURVNET_RESTORE();
354 		return;
355 	}
356 	if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
357 	    tp->t_inpcb && tp->t_inpcb->inp_socket &&
358 	    (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
359 		TCPSTAT_INC(tcps_finwait2_drops);
360 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
361 			tcp_inpinfo_lock_del(inp, tp);
362 			goto out;
363 		}
364 		NET_EPOCH_ENTER(et);
365 		tp = tcp_close(tp);
366 		NET_EPOCH_EXIT(et);
367 		tcp_inpinfo_lock_del(inp, tp);
368 		goto out;
369 	} else {
370 		if (ticks - tp->t_rcvtime <= TP_MAXIDLE(tp)) {
371 			callout_reset(&tp->t_timers->tt_2msl,
372 				      TP_KEEPINTVL(tp), tcp_timer_2msl, tp);
373 		} else {
374 			if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
375 				tcp_inpinfo_lock_del(inp, tp);
376 				goto out;
377 			}
378 			NET_EPOCH_ENTER(et);
379 			tp = tcp_close(tp);
380 			NET_EPOCH_EXIT(et);
381 			tcp_inpinfo_lock_del(inp, tp);
382 			goto out;
383 		}
384 	}
385 
386 #ifdef TCPDEBUG
387 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
388 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
389 			  PRU_SLOWTIMO);
390 #endif
391 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
392 
393 	if (tp != NULL)
394 		INP_WUNLOCK(inp);
395 out:
396 	CURVNET_RESTORE();
397 }
398 
399 void
400 tcp_timer_keep(void *xtp)
401 {
402 	struct tcpcb *tp = xtp;
403 	struct tcptemp *t_template;
404 	struct inpcb *inp;
405 	struct epoch_tracker et;
406 	CURVNET_SET(tp->t_vnet);
407 #ifdef TCPDEBUG
408 	int ostate;
409 
410 	ostate = tp->t_state;
411 #endif
412 	inp = tp->t_inpcb;
413 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL", __func__, tp));
414 	INP_WLOCK(inp);
415 	if (callout_pending(&tp->t_timers->tt_keep) ||
416 	    !callout_active(&tp->t_timers->tt_keep)) {
417 		INP_WUNLOCK(inp);
418 		CURVNET_RESTORE();
419 		return;
420 	}
421 	callout_deactivate(&tp->t_timers->tt_keep);
422 	if ((inp->inp_flags & INP_DROPPED) != 0) {
423 		INP_WUNLOCK(inp);
424 		CURVNET_RESTORE();
425 		return;
426 	}
427 	KASSERT((tp->t_timers->tt_flags & TT_STOPPED) == 0,
428 		("%s: tp %p tcpcb can't be stopped here", __func__, tp));
429 
430 	/*
431 	 * Because we don't regularly reset the keepalive callout in
432 	 * the ESTABLISHED state, it may be that we don't actually need
433 	 * to send a keepalive yet. If that occurs, schedule another
434 	 * call for the next time the keepalive timer might expire.
435 	 */
436 	if (TCPS_HAVEESTABLISHED(tp->t_state)) {
437 		u_int idletime;
438 
439 		idletime = ticks - tp->t_rcvtime;
440 		if (idletime < TP_KEEPIDLE(tp)) {
441 			callout_reset(&tp->t_timers->tt_keep,
442 			    TP_KEEPIDLE(tp) - idletime, tcp_timer_keep, tp);
443 			INP_WUNLOCK(inp);
444 			CURVNET_RESTORE();
445 			return;
446 		}
447 	}
448 
449 	/*
450 	 * Keep-alive timer went off; send something
451 	 * or drop connection if idle for too long.
452 	 */
453 	TCPSTAT_INC(tcps_keeptimeo);
454 	if (tp->t_state < TCPS_ESTABLISHED)
455 		goto dropit;
456 	if ((V_tcp_always_keepalive ||
457 	    inp->inp_socket->so_options & SO_KEEPALIVE) &&
458 	    tp->t_state <= TCPS_CLOSING) {
459 		if (ticks - tp->t_rcvtime >= TP_KEEPIDLE(tp) + TP_MAXIDLE(tp))
460 			goto dropit;
461 		/*
462 		 * Send a packet designed to force a response
463 		 * if the peer is up and reachable:
464 		 * either an ACK if the connection is still alive,
465 		 * or an RST if the peer has closed the connection
466 		 * due to timeout or reboot.
467 		 * Using sequence number tp->snd_una-1
468 		 * causes the transmitted zero-length segment
469 		 * to lie outside the receive window;
470 		 * by the protocol spec, this requires the
471 		 * correspondent TCP to respond.
472 		 */
473 		TCPSTAT_INC(tcps_keepprobe);
474 		t_template = tcpip_maketemplate(inp);
475 		if (t_template) {
476 			NET_EPOCH_ENTER(et);
477 			tcp_respond(tp, t_template->tt_ipgen,
478 				    &t_template->tt_t, (struct mbuf *)NULL,
479 				    tp->rcv_nxt, tp->snd_una - 1, 0);
480 			NET_EPOCH_EXIT(et);
481 			free(t_template, M_TEMP);
482 		}
483 		callout_reset(&tp->t_timers->tt_keep, TP_KEEPINTVL(tp),
484 			      tcp_timer_keep, tp);
485 	} else
486 		callout_reset(&tp->t_timers->tt_keep, TP_KEEPIDLE(tp),
487 			      tcp_timer_keep, tp);
488 
489 #ifdef TCPDEBUG
490 	if (inp->inp_socket->so_options & SO_DEBUG)
491 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
492 			  PRU_SLOWTIMO);
493 #endif
494 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
495 	INP_WUNLOCK(inp);
496 	CURVNET_RESTORE();
497 	return;
498 
499 dropit:
500 	TCPSTAT_INC(tcps_keepdrops);
501 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
502 		tcp_inpinfo_lock_del(inp, tp);
503 		goto out;
504 	}
505 	NET_EPOCH_ENTER(et);
506 	tp = tcp_drop(tp, ETIMEDOUT);
507 
508 #ifdef TCPDEBUG
509 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
510 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
511 			  PRU_SLOWTIMO);
512 #endif
513 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
514 	NET_EPOCH_EXIT(et);
515 	tcp_inpinfo_lock_del(inp, tp);
516  out:
517 	CURVNET_RESTORE();
518 }
519 
520 void
521 tcp_timer_persist(void *xtp)
522 {
523 	struct tcpcb *tp = xtp;
524 	struct inpcb *inp;
525 	struct epoch_tracker et;
526 	CURVNET_SET(tp->t_vnet);
527 #ifdef TCPDEBUG
528 	int ostate;
529 
530 	ostate = tp->t_state;
531 #endif
532 	inp = tp->t_inpcb;
533 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL", __func__, tp));
534 	INP_WLOCK(inp);
535 	if (callout_pending(&tp->t_timers->tt_persist) ||
536 	    !callout_active(&tp->t_timers->tt_persist)) {
537 		INP_WUNLOCK(inp);
538 		CURVNET_RESTORE();
539 		return;
540 	}
541 	callout_deactivate(&tp->t_timers->tt_persist);
542 	if ((inp->inp_flags & INP_DROPPED) != 0) {
543 		INP_WUNLOCK(inp);
544 		CURVNET_RESTORE();
545 		return;
546 	}
547 	KASSERT((tp->t_timers->tt_flags & TT_STOPPED) == 0,
548 		("%s: tp %p tcpcb can't be stopped here", __func__, tp));
549 	/*
550 	 * Persistence timer into zero window.
551 	 * Force a byte to be output, if possible.
552 	 */
553 	TCPSTAT_INC(tcps_persisttimeo);
554 	/*
555 	 * Hack: if the peer is dead/unreachable, we do not
556 	 * time out if the window is closed.  After a full
557 	 * backoff, drop the connection if the idle time
558 	 * (no responses to probes) reaches the maximum
559 	 * backoff that we would use if retransmitting.
560 	 */
561 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
562 	    (ticks - tp->t_rcvtime >= tcp_maxpersistidle ||
563 	     ticks - tp->t_rcvtime >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
564 		TCPSTAT_INC(tcps_persistdrop);
565 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
566 			tcp_inpinfo_lock_del(inp, tp);
567 			goto out;
568 		}
569 		NET_EPOCH_ENTER(et);
570 		tp = tcp_drop(tp, ETIMEDOUT);
571 		NET_EPOCH_EXIT(et);
572 		tcp_inpinfo_lock_del(inp, tp);
573 		goto out;
574 	}
575 	/*
576 	 * If the user has closed the socket then drop a persisting
577 	 * connection after a much reduced timeout.
578 	 */
579 	if (tp->t_state > TCPS_CLOSE_WAIT &&
580 	    (ticks - tp->t_rcvtime) >= TCPTV_PERSMAX) {
581 		TCPSTAT_INC(tcps_persistdrop);
582 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
583 			tcp_inpinfo_lock_del(inp, tp);
584 			goto out;
585 		}
586 		NET_EPOCH_ENTER(et);
587 		tp = tcp_drop(tp, ETIMEDOUT);
588 		NET_EPOCH_EXIT(et);
589 		tcp_inpinfo_lock_del(inp, tp);
590 		goto out;
591 	}
592 	tcp_setpersist(tp);
593 	tp->t_flags |= TF_FORCEDATA;
594 	NET_EPOCH_ENTER(et);
595 	(void) tp->t_fb->tfb_tcp_output(tp);
596 	NET_EPOCH_EXIT(et);
597 	tp->t_flags &= ~TF_FORCEDATA;
598 
599 #ifdef TCPDEBUG
600 	if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
601 		tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
602 #endif
603 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
604 	INP_WUNLOCK(inp);
605 out:
606 	CURVNET_RESTORE();
607 }
608 
609 void
610 tcp_timer_rexmt(void * xtp)
611 {
612 	struct tcpcb *tp = xtp;
613 	CURVNET_SET(tp->t_vnet);
614 	int rexmt;
615 	struct inpcb *inp;
616 	struct epoch_tracker et;
617 #ifdef TCPDEBUG
618 	int ostate;
619 
620 	ostate = tp->t_state;
621 #endif
622 	inp = tp->t_inpcb;
623 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL", __func__, tp));
624 	INP_WLOCK(inp);
625 	if (callout_pending(&tp->t_timers->tt_rexmt) ||
626 	    !callout_active(&tp->t_timers->tt_rexmt)) {
627 		INP_WUNLOCK(inp);
628 		CURVNET_RESTORE();
629 		return;
630 	}
631 	callout_deactivate(&tp->t_timers->tt_rexmt);
632 	if ((inp->inp_flags & INP_DROPPED) != 0) {
633 		INP_WUNLOCK(inp);
634 		CURVNET_RESTORE();
635 		return;
636 	}
637 	KASSERT((tp->t_timers->tt_flags & TT_STOPPED) == 0,
638 		("%s: tp %p tcpcb can't be stopped here", __func__, tp));
639 	tcp_free_sackholes(tp);
640 	TCP_LOG_EVENT(tp, NULL, NULL, NULL, TCP_LOG_RTO, 0, 0, NULL, false);
641 	if (tp->t_fb->tfb_tcp_rexmit_tmr) {
642 		/* The stack has a timer action too. */
643 		(*tp->t_fb->tfb_tcp_rexmit_tmr)(tp);
644 	}
645 	/*
646 	 * Retransmission timer went off.  Message has not
647 	 * been acked within retransmit interval.  Back off
648 	 * to a longer retransmit interval and retransmit one segment.
649 	 */
650 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
651 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
652 		TCPSTAT_INC(tcps_timeoutdrop);
653 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
654 			tcp_inpinfo_lock_del(inp, tp);
655 			goto out;
656 		}
657 		NET_EPOCH_ENTER(et);
658 		tp = tcp_drop(tp, ETIMEDOUT);
659 		NET_EPOCH_EXIT(et);
660 		tcp_inpinfo_lock_del(inp, tp);
661 		goto out;
662 	}
663 	if (tp->t_state == TCPS_SYN_SENT) {
664 		/*
665 		 * If the SYN was retransmitted, indicate CWND to be
666 		 * limited to 1 segment in cc_conn_init().
667 		 */
668 		tp->snd_cwnd = 1;
669 	} else if (tp->t_rxtshift == 1) {
670 		/*
671 		 * first retransmit; record ssthresh and cwnd so they can
672 		 * be recovered if this turns out to be a "bad" retransmit.
673 		 * A retransmit is considered "bad" if an ACK for this
674 		 * segment is received within RTT/2 interval; the assumption
675 		 * here is that the ACK was already in flight.  See
676 		 * "On Estimating End-to-End Network Path Properties" by
677 		 * Allman and Paxson for more details.
678 		 */
679 		tp->snd_cwnd_prev = tp->snd_cwnd;
680 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
681 		tp->snd_recover_prev = tp->snd_recover;
682 		if (IN_FASTRECOVERY(tp->t_flags))
683 			tp->t_flags |= TF_WASFRECOVERY;
684 		else
685 			tp->t_flags &= ~TF_WASFRECOVERY;
686 		if (IN_CONGRECOVERY(tp->t_flags))
687 			tp->t_flags |= TF_WASCRECOVERY;
688 		else
689 			tp->t_flags &= ~TF_WASCRECOVERY;
690 		if ((tp->t_flags & TF_RCVD_TSTMP) == 0)
691 			tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
692 		/* In the event that we've negotiated timestamps
693 		 * badrxtwin will be set to the value that we set
694 		 * the retransmitted packet's to_tsval to by tcp_output
695 		 */
696 		tp->t_flags |= TF_PREVVALID;
697 	} else
698 		tp->t_flags &= ~TF_PREVVALID;
699 	TCPSTAT_INC(tcps_rexmttimeo);
700 	if ((tp->t_state == TCPS_SYN_SENT) ||
701 	    (tp->t_state == TCPS_SYN_RECEIVED))
702 		rexmt = tcp_rexmit_initial * tcp_backoff[tp->t_rxtshift];
703 	else
704 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
705 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
706 		      tp->t_rttmin, TCPTV_REXMTMAX);
707 
708 	/*
709 	 * We enter the path for PLMTUD if connection is established or, if
710 	 * connection is FIN_WAIT_1 status, reason for the last is that if
711 	 * amount of data we send is very small, we could send it in couple of
712 	 * packets and process straight to FIN. In that case we won't catch
713 	 * ESTABLISHED state.
714 	 */
715 	if (V_tcp_pmtud_blackhole_detect && (((tp->t_state == TCPS_ESTABLISHED))
716 	    || (tp->t_state == TCPS_FIN_WAIT_1))) {
717 #ifdef INET6
718 		int isipv6;
719 #endif
720 
721 		/*
722 		 * Idea here is that at each stage of mtu probe (usually, 1448
723 		 * -> 1188 -> 524) should be given 2 chances to recover before
724 		 *  further clamping down. 'tp->t_rxtshift % 2 == 0' should
725 		 *  take care of that.
726 		 */
727 		if (((tp->t_flags2 & (TF2_PLPMTU_PMTUD|TF2_PLPMTU_MAXSEGSNT)) ==
728 		    (TF2_PLPMTU_PMTUD|TF2_PLPMTU_MAXSEGSNT)) &&
729 		    (tp->t_rxtshift >= 2 && tp->t_rxtshift < 6 &&
730 		    tp->t_rxtshift % 2 == 0)) {
731 			/*
732 			 * Enter Path MTU Black-hole Detection mechanism:
733 			 * - Disable Path MTU Discovery (IP "DF" bit).
734 			 * - Reduce MTU to lower value than what we
735 			 *   negotiated with peer.
736 			 */
737 			if ((tp->t_flags2 & TF2_PLPMTU_BLACKHOLE) == 0) {
738 				/* Record that we may have found a black hole. */
739 				tp->t_flags2 |= TF2_PLPMTU_BLACKHOLE;
740 				/* Keep track of previous MSS. */
741 				tp->t_pmtud_saved_maxseg = tp->t_maxseg;
742 			}
743 
744 			/*
745 			 * Reduce the MSS to blackhole value or to the default
746 			 * in an attempt to retransmit.
747 			 */
748 #ifdef INET6
749 			isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) ? 1 : 0;
750 			if (isipv6 &&
751 			    tp->t_maxseg > V_tcp_v6pmtud_blackhole_mss) {
752 				/* Use the sysctl tuneable blackhole MSS. */
753 				tp->t_maxseg = V_tcp_v6pmtud_blackhole_mss;
754 				TCPSTAT_INC(tcps_pmtud_blackhole_activated);
755 			} else if (isipv6) {
756 				/* Use the default MSS. */
757 				tp->t_maxseg = V_tcp_v6mssdflt;
758 				/*
759 				 * Disable Path MTU Discovery when we switch to
760 				 * minmss.
761 				 */
762 				tp->t_flags2 &= ~TF2_PLPMTU_PMTUD;
763 				TCPSTAT_INC(tcps_pmtud_blackhole_activated_min_mss);
764 			}
765 #endif
766 #if defined(INET6) && defined(INET)
767 			else
768 #endif
769 #ifdef INET
770 			if (tp->t_maxseg > V_tcp_pmtud_blackhole_mss) {
771 				/* Use the sysctl tuneable blackhole MSS. */
772 				tp->t_maxseg = V_tcp_pmtud_blackhole_mss;
773 				TCPSTAT_INC(tcps_pmtud_blackhole_activated);
774 			} else {
775 				/* Use the default MSS. */
776 				tp->t_maxseg = V_tcp_mssdflt;
777 				/*
778 				 * Disable Path MTU Discovery when we switch to
779 				 * minmss.
780 				 */
781 				tp->t_flags2 &= ~TF2_PLPMTU_PMTUD;
782 				TCPSTAT_INC(tcps_pmtud_blackhole_activated_min_mss);
783 			}
784 #endif
785 			/*
786 			 * Reset the slow-start flight size
787 			 * as it may depend on the new MSS.
788 			 */
789 			if (CC_ALGO(tp)->conn_init != NULL)
790 				CC_ALGO(tp)->conn_init(tp->ccv);
791 		} else {
792 			/*
793 			 * If further retransmissions are still unsuccessful
794 			 * with a lowered MTU, maybe this isn't a blackhole and
795 			 * we restore the previous MSS and blackhole detection
796 			 * flags.
797 			 * The limit '6' is determined by giving each probe
798 			 * stage (1448, 1188, 524) 2 chances to recover.
799 			 */
800 			if ((tp->t_flags2 & TF2_PLPMTU_BLACKHOLE) &&
801 			    (tp->t_rxtshift >= 6)) {
802 				tp->t_flags2 |= TF2_PLPMTU_PMTUD;
803 				tp->t_flags2 &= ~TF2_PLPMTU_BLACKHOLE;
804 				tp->t_maxseg = tp->t_pmtud_saved_maxseg;
805 				TCPSTAT_INC(tcps_pmtud_blackhole_failed);
806 				/*
807 				 * Reset the slow-start flight size as it
808 				 * may depend on the new MSS.
809 				 */
810 				if (CC_ALGO(tp)->conn_init != NULL)
811 					CC_ALGO(tp)->conn_init(tp->ccv);
812 			}
813 		}
814 	}
815 
816 	/*
817 	 * Disable RFC1323 and SACK if we haven't got any response to
818 	 * our third SYN to work-around some broken terminal servers
819 	 * (most of which have hopefully been retired) that have bad VJ
820 	 * header compression code which trashes TCP segments containing
821 	 * unknown-to-them TCP options.
822 	 */
823 	if (tcp_rexmit_drop_options && (tp->t_state == TCPS_SYN_SENT) &&
824 	    (tp->t_rxtshift == 3))
825 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP|TF_SACK_PERMIT);
826 	/*
827 	 * If we backed off this far, notify the L3 protocol that we're having
828 	 * connection problems.
829 	 */
830 	if (tp->t_rxtshift > TCP_RTT_INVALIDATE) {
831 #ifdef INET6
832 		if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
833 			in6_losing(tp->t_inpcb);
834 		else
835 #endif
836 			in_losing(tp->t_inpcb);
837 	}
838 	tp->snd_nxt = tp->snd_una;
839 	tp->snd_recover = tp->snd_max;
840 	/*
841 	 * Force a segment to be sent.
842 	 */
843 	tp->t_flags |= TF_ACKNOW;
844 	/*
845 	 * If timing a segment in this window, stop the timer.
846 	 */
847 	tp->t_rtttime = 0;
848 
849 	cc_cong_signal(tp, NULL, CC_RTO);
850 	NET_EPOCH_ENTER(et);
851 	(void) tp->t_fb->tfb_tcp_output(tp);
852 	NET_EPOCH_EXIT(et);
853 #ifdef TCPDEBUG
854 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
855 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
856 			  PRU_SLOWTIMO);
857 #endif
858 	TCP_PROBE2(debug__user, tp, PRU_SLOWTIMO);
859 	INP_WUNLOCK(inp);
860 out:
861 	CURVNET_RESTORE();
862 }
863 
864 void
865 tcp_timer_activate(struct tcpcb *tp, uint32_t timer_type, u_int delta)
866 {
867 	struct callout *t_callout;
868 	callout_func_t *f_callout;
869 	struct inpcb *inp = tp->t_inpcb;
870 	int cpu = inp_to_cpuid(inp);
871 
872 #ifdef TCP_OFFLOAD
873 	if (tp->t_flags & TF_TOE)
874 		return;
875 #endif
876 
877 	if (tp->t_timers->tt_flags & TT_STOPPED)
878 		return;
879 
880 	switch (timer_type) {
881 		case TT_DELACK:
882 			t_callout = &tp->t_timers->tt_delack;
883 			f_callout = tcp_timer_delack;
884 			break;
885 		case TT_REXMT:
886 			t_callout = &tp->t_timers->tt_rexmt;
887 			f_callout = tcp_timer_rexmt;
888 			break;
889 		case TT_PERSIST:
890 			t_callout = &tp->t_timers->tt_persist;
891 			f_callout = tcp_timer_persist;
892 			break;
893 		case TT_KEEP:
894 			t_callout = &tp->t_timers->tt_keep;
895 			f_callout = tcp_timer_keep;
896 			break;
897 		case TT_2MSL:
898 			t_callout = &tp->t_timers->tt_2msl;
899 			f_callout = tcp_timer_2msl;
900 			break;
901 		default:
902 			if (tp->t_fb->tfb_tcp_timer_activate) {
903 				tp->t_fb->tfb_tcp_timer_activate(tp, timer_type, delta);
904 				return;
905 			}
906 			panic("tp %p bad timer_type %#x", tp, timer_type);
907 		}
908 	if (delta == 0) {
909 		callout_stop(t_callout);
910 	} else {
911 		callout_reset_on(t_callout, delta, f_callout, tp, cpu);
912 	}
913 }
914 
915 int
916 tcp_timer_active(struct tcpcb *tp, uint32_t timer_type)
917 {
918 	struct callout *t_callout;
919 
920 	switch (timer_type) {
921 		case TT_DELACK:
922 			t_callout = &tp->t_timers->tt_delack;
923 			break;
924 		case TT_REXMT:
925 			t_callout = &tp->t_timers->tt_rexmt;
926 			break;
927 		case TT_PERSIST:
928 			t_callout = &tp->t_timers->tt_persist;
929 			break;
930 		case TT_KEEP:
931 			t_callout = &tp->t_timers->tt_keep;
932 			break;
933 		case TT_2MSL:
934 			t_callout = &tp->t_timers->tt_2msl;
935 			break;
936 		default:
937 			if (tp->t_fb->tfb_tcp_timer_active) {
938 				return(tp->t_fb->tfb_tcp_timer_active(tp, timer_type));
939 			}
940 			panic("tp %p bad timer_type %#x", tp, timer_type);
941 		}
942 	return callout_active(t_callout);
943 }
944 
945 /*
946  * Stop the timer from running, and apply a flag
947  * against the timer_flags that will force the
948  * timer never to run. The flag is needed to assure
949  * a race does not leave it running and cause
950  * the timer to possibly restart itself (keep and persist
951  * especially do this).
952  */
953 int
954 tcp_timer_suspend(struct tcpcb *tp, uint32_t timer_type)
955 {
956 	struct callout *t_callout;
957 	uint32_t t_flags;
958 
959 	switch (timer_type) {
960 		case TT_DELACK:
961 			t_flags = TT_DELACK_SUS;
962 			t_callout = &tp->t_timers->tt_delack;
963 			break;
964 		case TT_REXMT:
965 			t_flags = TT_REXMT_SUS;
966 			t_callout = &tp->t_timers->tt_rexmt;
967 			break;
968 		case TT_PERSIST:
969 			t_flags = TT_PERSIST_SUS;
970 			t_callout = &tp->t_timers->tt_persist;
971 			break;
972 		case TT_KEEP:
973 			t_flags = TT_KEEP_SUS;
974 			t_callout = &tp->t_timers->tt_keep;
975 			break;
976 		case TT_2MSL:
977 			t_flags = TT_2MSL_SUS;
978 			t_callout = &tp->t_timers->tt_2msl;
979 			break;
980 		default:
981 			panic("tp:%p bad timer_type 0x%x", tp, timer_type);
982 	}
983 	tp->t_timers->tt_flags |= t_flags;
984 	return (callout_stop(t_callout));
985 }
986 
987 void
988 tcp_timers_unsuspend(struct tcpcb *tp, uint32_t timer_type)
989 {
990 	switch (timer_type) {
991 		case TT_DELACK:
992 			if (tp->t_timers->tt_flags & TT_DELACK_SUS) {
993 				tp->t_timers->tt_flags &= ~TT_DELACK_SUS;
994 				if (tp->t_flags & TF_DELACK) {
995 					/* Delayed ack timer should be up activate a timer */
996 					tp->t_flags &= ~TF_DELACK;
997 					tcp_timer_activate(tp, TT_DELACK,
998 					    tcp_delacktime);
999 				}
1000 			}
1001 			break;
1002 		case TT_REXMT:
1003 			if (tp->t_timers->tt_flags & TT_REXMT_SUS) {
1004 				tp->t_timers->tt_flags &= ~TT_REXMT_SUS;
1005 				if (SEQ_GT(tp->snd_max, tp->snd_una) &&
1006 				    (tcp_timer_active((tp), TT_PERSIST) == 0) &&
1007 				    tp->snd_wnd) {
1008 					/* We have outstanding data activate a timer */
1009 					tcp_timer_activate(tp, TT_REXMT,
1010                                             tp->t_rxtcur);
1011 				}
1012 			}
1013 			break;
1014 		case TT_PERSIST:
1015 			if (tp->t_timers->tt_flags & TT_PERSIST_SUS) {
1016 				tp->t_timers->tt_flags &= ~TT_PERSIST_SUS;
1017 				if (tp->snd_wnd == 0) {
1018 					/* Activate the persists timer */
1019 					tp->t_rxtshift = 0;
1020 					tcp_setpersist(tp);
1021 				}
1022 			}
1023 			break;
1024 		case TT_KEEP:
1025 			if (tp->t_timers->tt_flags & TT_KEEP_SUS) {
1026 				tp->t_timers->tt_flags &= ~TT_KEEP_SUS;
1027 				tcp_timer_activate(tp, TT_KEEP,
1028 					    TCPS_HAVEESTABLISHED(tp->t_state) ?
1029 					    TP_KEEPIDLE(tp) : TP_KEEPINIT(tp));
1030 			}
1031 			break;
1032 		case TT_2MSL:
1033 			if (tp->t_timers->tt_flags &= TT_2MSL_SUS) {
1034 				tp->t_timers->tt_flags &= ~TT_2MSL_SUS;
1035 				if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1036 				    ((tp->t_inpcb->inp_socket == NULL) ||
1037 				     (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE))) {
1038 					/* Star the 2MSL timer */
1039 					tcp_timer_activate(tp, TT_2MSL,
1040 					    (tcp_fast_finwait2_recycle) ?
1041 					    tcp_finwait2_timeout : TP_MAXIDLE(tp));
1042 				}
1043 			}
1044 			break;
1045 		default:
1046 			panic("tp:%p bad timer_type 0x%x", tp, timer_type);
1047 	}
1048 }
1049 
1050 void
1051 tcp_timer_stop(struct tcpcb *tp, uint32_t timer_type)
1052 {
1053 	struct callout *t_callout;
1054 
1055 	tp->t_timers->tt_flags |= TT_STOPPED;
1056 	switch (timer_type) {
1057 		case TT_DELACK:
1058 			t_callout = &tp->t_timers->tt_delack;
1059 			break;
1060 		case TT_REXMT:
1061 			t_callout = &tp->t_timers->tt_rexmt;
1062 			break;
1063 		case TT_PERSIST:
1064 			t_callout = &tp->t_timers->tt_persist;
1065 			break;
1066 		case TT_KEEP:
1067 			t_callout = &tp->t_timers->tt_keep;
1068 			break;
1069 		case TT_2MSL:
1070 			t_callout = &tp->t_timers->tt_2msl;
1071 			break;
1072 		default:
1073 			if (tp->t_fb->tfb_tcp_timer_stop) {
1074 				/*
1075 				 * XXXrrs we need to look at this with the
1076 				 * stop case below (flags).
1077 				 */
1078 				tp->t_fb->tfb_tcp_timer_stop(tp, timer_type);
1079 				return;
1080 			}
1081 			panic("tp %p bad timer_type %#x", tp, timer_type);
1082 		}
1083 
1084 	if (callout_async_drain(t_callout, tcp_timer_discard) == 0) {
1085 		/*
1086 		 * Can't stop the callout, defer tcpcb actual deletion
1087 		 * to the last one. We do this using the async drain
1088 		 * function and incrementing the count in
1089 		 */
1090 		tp->t_timers->tt_draincnt++;
1091 	}
1092 }
1093