xref: /freebsd/sys/netinet/tcp_timer.c (revision eb6d21b4ca6d668cf89afd99eef7baeafa712197)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet6.h"
36 #include "opt_tcpdebug.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/mbuf.h>
42 #include <sys/mutex.h>
43 #include <sys/protosw.h>
44 #include <sys/socket.h>
45 #include <sys/socketvar.h>
46 #include <sys/sysctl.h>
47 #include <sys/systm.h>
48 
49 #include <net/if.h>
50 #include <net/route.h>
51 #include <net/vnet.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_pcb.h>
55 #include <netinet/in_systm.h>
56 #ifdef INET6
57 #include <netinet6/in6_pcb.h>
58 #endif
59 #include <netinet/ip_var.h>
60 #include <netinet/tcp.h>
61 #include <netinet/tcp_fsm.h>
62 #include <netinet/tcp_timer.h>
63 #include <netinet/tcp_var.h>
64 #include <netinet/tcpip.h>
65 #ifdef TCPDEBUG
66 #include <netinet/tcp_debug.h>
67 #endif
68 
69 int	tcp_keepinit;
70 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT|CTLFLAG_RW,
71     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "time to establish connection");
72 
73 int	tcp_keepidle;
74 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT|CTLFLAG_RW,
75     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "time before keepalive probes begin");
76 
77 int	tcp_keepintvl;
78 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT|CTLFLAG_RW,
79     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "time between keepalive probes");
80 
81 int	tcp_delacktime;
82 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime, CTLTYPE_INT|CTLFLAG_RW,
83     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
84     "Time before a delayed ACK is sent");
85 
86 int	tcp_msl;
87 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT|CTLFLAG_RW,
88     &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
89 
90 int	tcp_rexmit_min;
91 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT|CTLFLAG_RW,
92     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
93     "Minimum Retransmission Timeout");
94 
95 int	tcp_rexmit_slop;
96 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT|CTLFLAG_RW,
97     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
98     "Retransmission Timer Slop");
99 
100 static int	always_keepalive = 1;
101 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_RW,
102     &always_keepalive , 0, "Assume SO_KEEPALIVE on all TCP connections");
103 
104 int    tcp_fast_finwait2_recycle = 0;
105 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
106     &tcp_fast_finwait2_recycle, 0,
107     "Recycle closed FIN_WAIT_2 connections faster");
108 
109 int    tcp_finwait2_timeout;
110 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT|CTLFLAG_RW,
111     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "FIN-WAIT2 timeout");
112 
113 
114 static int	tcp_keepcnt = TCPTV_KEEPCNT;
115 	/* max idle probes */
116 int	tcp_maxpersistidle;
117 	/* max idle time in persist */
118 int	tcp_maxidle;
119 
120 /*
121  * Tcp protocol timeout routine called every 500 ms.
122  * Updates timestamps used for TCP
123  * causes finite state machine actions if timers expire.
124  */
125 void
126 tcp_slowtimo(void)
127 {
128 	VNET_ITERATOR_DECL(vnet_iter);
129 
130 	VNET_LIST_RLOCK_NOSLEEP();
131 	VNET_FOREACH(vnet_iter) {
132 		CURVNET_SET(vnet_iter);
133 		tcp_maxidle = tcp_keepcnt * tcp_keepintvl;
134 		INP_INFO_WLOCK(&V_tcbinfo);
135 		(void) tcp_tw_2msl_scan(0);
136 		INP_INFO_WUNLOCK(&V_tcbinfo);
137 		CURVNET_RESTORE();
138 	}
139 	VNET_LIST_RUNLOCK_NOSLEEP();
140 }
141 
142 int	tcp_syn_backoff[TCP_MAXRXTSHIFT + 1] =
143     { 1, 1, 1, 1, 1, 2, 4, 8, 16, 32, 64, 64, 64 };
144 
145 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
146     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
147 
148 static int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
149 
150 static int tcp_timer_race;
151 SYSCTL_INT(_net_inet_tcp, OID_AUTO, timer_race, CTLFLAG_RD, &tcp_timer_race,
152     0, "Count of t_inpcb races on tcp_discardcb");
153 
154 /*
155  * TCP timer processing.
156  */
157 
158 void
159 tcp_timer_delack(void *xtp)
160 {
161 	struct tcpcb *tp = xtp;
162 	struct inpcb *inp;
163 	CURVNET_SET(tp->t_vnet);
164 
165 	INP_INFO_RLOCK(&V_tcbinfo);
166 	inp = tp->t_inpcb;
167 	/*
168 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
169 	 * tear-down mean we need it as a work-around for races between
170 	 * timers and tcp_discardcb().
171 	 *
172 	 * KASSERT(inp != NULL, ("tcp_timer_delack: inp == NULL"));
173 	 */
174 	if (inp == NULL) {
175 		tcp_timer_race++;
176 		INP_INFO_RUNLOCK(&V_tcbinfo);
177 		CURVNET_RESTORE();
178 		return;
179 	}
180 	INP_WLOCK(inp);
181 	INP_INFO_RUNLOCK(&V_tcbinfo);
182 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_delack)
183 	    || !callout_active(&tp->t_timers->tt_delack)) {
184 		INP_WUNLOCK(inp);
185 		CURVNET_RESTORE();
186 		return;
187 	}
188 	callout_deactivate(&tp->t_timers->tt_delack);
189 
190 	tp->t_flags |= TF_ACKNOW;
191 	TCPSTAT_INC(tcps_delack);
192 	(void) tcp_output(tp);
193 	INP_WUNLOCK(inp);
194 	CURVNET_RESTORE();
195 }
196 
197 void
198 tcp_timer_2msl(void *xtp)
199 {
200 	struct tcpcb *tp = xtp;
201 	struct inpcb *inp;
202 	CURVNET_SET(tp->t_vnet);
203 #ifdef TCPDEBUG
204 	int ostate;
205 
206 	ostate = tp->t_state;
207 #endif
208 	/*
209 	 * XXXRW: Does this actually happen?
210 	 */
211 	INP_INFO_WLOCK(&V_tcbinfo);
212 	inp = tp->t_inpcb;
213 	/*
214 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
215 	 * tear-down mean we need it as a work-around for races between
216 	 * timers and tcp_discardcb().
217 	 *
218 	 * KASSERT(inp != NULL, ("tcp_timer_2msl: inp == NULL"));
219 	 */
220 	if (inp == NULL) {
221 		tcp_timer_race++;
222 		INP_INFO_WUNLOCK(&V_tcbinfo);
223 		CURVNET_RESTORE();
224 		return;
225 	}
226 	INP_WLOCK(inp);
227 	tcp_free_sackholes(tp);
228 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_2msl) ||
229 	    !callout_active(&tp->t_timers->tt_2msl)) {
230 		INP_WUNLOCK(tp->t_inpcb);
231 		INP_INFO_WUNLOCK(&V_tcbinfo);
232 		CURVNET_RESTORE();
233 		return;
234 	}
235 	callout_deactivate(&tp->t_timers->tt_2msl);
236 	/*
237 	 * 2 MSL timeout in shutdown went off.  If we're closed but
238 	 * still waiting for peer to close and connection has been idle
239 	 * too long, or if 2MSL time is up from TIME_WAIT, delete connection
240 	 * control block.  Otherwise, check again in a bit.
241 	 *
242 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
243 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
244 	 * Ignore fact that there were recent incoming segments.
245 	 */
246 	if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
247 	    tp->t_inpcb && tp->t_inpcb->inp_socket &&
248 	    (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
249 		TCPSTAT_INC(tcps_finwait2_drops);
250 		tp = tcp_close(tp);
251 	} else {
252 		if (tp->t_state != TCPS_TIME_WAIT &&
253 		   ticks - tp->t_rcvtime <= tcp_maxidle)
254 		       callout_reset(&tp->t_timers->tt_2msl, tcp_keepintvl,
255 				     tcp_timer_2msl, tp);
256 	       else
257 		       tp = tcp_close(tp);
258        }
259 
260 #ifdef TCPDEBUG
261 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
262 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
263 			  PRU_SLOWTIMO);
264 #endif
265 	if (tp != NULL)
266 		INP_WUNLOCK(inp);
267 	INP_INFO_WUNLOCK(&V_tcbinfo);
268 	CURVNET_RESTORE();
269 }
270 
271 void
272 tcp_timer_keep(void *xtp)
273 {
274 	struct tcpcb *tp = xtp;
275 	struct tcptemp *t_template;
276 	struct inpcb *inp;
277 	CURVNET_SET(tp->t_vnet);
278 #ifdef TCPDEBUG
279 	int ostate;
280 
281 	ostate = tp->t_state;
282 #endif
283 	INP_INFO_WLOCK(&V_tcbinfo);
284 	inp = tp->t_inpcb;
285 	/*
286 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
287 	 * tear-down mean we need it as a work-around for races between
288 	 * timers and tcp_discardcb().
289 	 *
290 	 * KASSERT(inp != NULL, ("tcp_timer_keep: inp == NULL"));
291 	 */
292 	if (inp == NULL) {
293 		tcp_timer_race++;
294 		INP_INFO_WUNLOCK(&V_tcbinfo);
295 		CURVNET_RESTORE();
296 		return;
297 	}
298 	INP_WLOCK(inp);
299 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_keep)
300 	    || !callout_active(&tp->t_timers->tt_keep)) {
301 		INP_WUNLOCK(inp);
302 		INP_INFO_WUNLOCK(&V_tcbinfo);
303 		CURVNET_RESTORE();
304 		return;
305 	}
306 	callout_deactivate(&tp->t_timers->tt_keep);
307 	/*
308 	 * Keep-alive timer went off; send something
309 	 * or drop connection if idle for too long.
310 	 */
311 	TCPSTAT_INC(tcps_keeptimeo);
312 	if (tp->t_state < TCPS_ESTABLISHED)
313 		goto dropit;
314 	if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
315 	    tp->t_state <= TCPS_CLOSING) {
316 		if (ticks - tp->t_rcvtime >= tcp_keepidle + tcp_maxidle)
317 			goto dropit;
318 		/*
319 		 * Send a packet designed to force a response
320 		 * if the peer is up and reachable:
321 		 * either an ACK if the connection is still alive,
322 		 * or an RST if the peer has closed the connection
323 		 * due to timeout or reboot.
324 		 * Using sequence number tp->snd_una-1
325 		 * causes the transmitted zero-length segment
326 		 * to lie outside the receive window;
327 		 * by the protocol spec, this requires the
328 		 * correspondent TCP to respond.
329 		 */
330 		TCPSTAT_INC(tcps_keepprobe);
331 		t_template = tcpip_maketemplate(inp);
332 		if (t_template) {
333 			tcp_respond(tp, t_template->tt_ipgen,
334 				    &t_template->tt_t, (struct mbuf *)NULL,
335 				    tp->rcv_nxt, tp->snd_una - 1, 0);
336 			free(t_template, M_TEMP);
337 		}
338 		callout_reset(&tp->t_timers->tt_keep, tcp_keepintvl, tcp_timer_keep, tp);
339 	} else
340 		callout_reset(&tp->t_timers->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
341 
342 #ifdef TCPDEBUG
343 	if (inp->inp_socket->so_options & SO_DEBUG)
344 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
345 			  PRU_SLOWTIMO);
346 #endif
347 	INP_WUNLOCK(inp);
348 	INP_INFO_WUNLOCK(&V_tcbinfo);
349 	CURVNET_RESTORE();
350 	return;
351 
352 dropit:
353 	TCPSTAT_INC(tcps_keepdrops);
354 	tp = tcp_drop(tp, ETIMEDOUT);
355 
356 #ifdef TCPDEBUG
357 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
358 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
359 			  PRU_SLOWTIMO);
360 #endif
361 	if (tp != NULL)
362 		INP_WUNLOCK(tp->t_inpcb);
363 	INP_INFO_WUNLOCK(&V_tcbinfo);
364 	CURVNET_RESTORE();
365 }
366 
367 void
368 tcp_timer_persist(void *xtp)
369 {
370 	struct tcpcb *tp = xtp;
371 	struct inpcb *inp;
372 	CURVNET_SET(tp->t_vnet);
373 #ifdef TCPDEBUG
374 	int ostate;
375 
376 	ostate = tp->t_state;
377 #endif
378 	INP_INFO_WLOCK(&V_tcbinfo);
379 	inp = tp->t_inpcb;
380 	/*
381 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
382 	 * tear-down mean we need it as a work-around for races between
383 	 * timers and tcp_discardcb().
384 	 *
385 	 * KASSERT(inp != NULL, ("tcp_timer_persist: inp == NULL"));
386 	 */
387 	if (inp == NULL) {
388 		tcp_timer_race++;
389 		INP_INFO_WUNLOCK(&V_tcbinfo);
390 		CURVNET_RESTORE();
391 		return;
392 	}
393 	INP_WLOCK(inp);
394 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_persist)
395 	    || !callout_active(&tp->t_timers->tt_persist)) {
396 		INP_WUNLOCK(inp);
397 		INP_INFO_WUNLOCK(&V_tcbinfo);
398 		CURVNET_RESTORE();
399 		return;
400 	}
401 	callout_deactivate(&tp->t_timers->tt_persist);
402 	/*
403 	 * Persistance timer into zero window.
404 	 * Force a byte to be output, if possible.
405 	 */
406 	TCPSTAT_INC(tcps_persisttimeo);
407 	/*
408 	 * Hack: if the peer is dead/unreachable, we do not
409 	 * time out if the window is closed.  After a full
410 	 * backoff, drop the connection if the idle time
411 	 * (no responses to probes) reaches the maximum
412 	 * backoff that we would use if retransmitting.
413 	 */
414 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
415 	    (ticks - tp->t_rcvtime >= tcp_maxpersistidle ||
416 	     ticks - tp->t_rcvtime >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
417 		TCPSTAT_INC(tcps_persistdrop);
418 		tp = tcp_drop(tp, ETIMEDOUT);
419 		goto out;
420 	}
421 	tcp_setpersist(tp);
422 	tp->t_flags |= TF_FORCEDATA;
423 	(void) tcp_output(tp);
424 	tp->t_flags &= ~TF_FORCEDATA;
425 
426 out:
427 #ifdef TCPDEBUG
428 	if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
429 		tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
430 #endif
431 	if (tp != NULL)
432 		INP_WUNLOCK(inp);
433 	INP_INFO_WUNLOCK(&V_tcbinfo);
434 	CURVNET_RESTORE();
435 }
436 
437 void
438 tcp_timer_rexmt(void * xtp)
439 {
440 	struct tcpcb *tp = xtp;
441 	CURVNET_SET(tp->t_vnet);
442 	int rexmt;
443 	int headlocked;
444 	struct inpcb *inp;
445 #ifdef TCPDEBUG
446 	int ostate;
447 
448 	ostate = tp->t_state;
449 #endif
450 	INP_INFO_WLOCK(&V_tcbinfo);
451 	headlocked = 1;
452 	inp = tp->t_inpcb;
453 	/*
454 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
455 	 * tear-down mean we need it as a work-around for races between
456 	 * timers and tcp_discardcb().
457 	 *
458 	 * KASSERT(inp != NULL, ("tcp_timer_rexmt: inp == NULL"));
459 	 */
460 	if (inp == NULL) {
461 		tcp_timer_race++;
462 		INP_INFO_WUNLOCK(&V_tcbinfo);
463 		CURVNET_RESTORE();
464 		return;
465 	}
466 	INP_WLOCK(inp);
467 	if ((inp->inp_flags & INP_DROPPED) || callout_pending(&tp->t_timers->tt_rexmt)
468 	    || !callout_active(&tp->t_timers->tt_rexmt)) {
469 		INP_WUNLOCK(inp);
470 		INP_INFO_WUNLOCK(&V_tcbinfo);
471 		CURVNET_RESTORE();
472 		return;
473 	}
474 	callout_deactivate(&tp->t_timers->tt_rexmt);
475 	tcp_free_sackholes(tp);
476 	/*
477 	 * Retransmission timer went off.  Message has not
478 	 * been acked within retransmit interval.  Back off
479 	 * to a longer retransmit interval and retransmit one segment.
480 	 */
481 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
482 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
483 		TCPSTAT_INC(tcps_timeoutdrop);
484 		tp = tcp_drop(tp, tp->t_softerror ?
485 			      tp->t_softerror : ETIMEDOUT);
486 		goto out;
487 	}
488 	INP_INFO_WUNLOCK(&V_tcbinfo);
489 	headlocked = 0;
490 	if (tp->t_rxtshift == 1) {
491 		/*
492 		 * first retransmit; record ssthresh and cwnd so they can
493 		 * be recovered if this turns out to be a "bad" retransmit.
494 		 * A retransmit is considered "bad" if an ACK for this
495 		 * segment is received within RTT/2 interval; the assumption
496 		 * here is that the ACK was already in flight.  See
497 		 * "On Estimating End-to-End Network Path Properties" by
498 		 * Allman and Paxson for more details.
499 		 */
500 		tp->snd_cwnd_prev = tp->snd_cwnd;
501 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
502 		tp->snd_recover_prev = tp->snd_recover;
503 		if (IN_FASTRECOVERY(tp))
504 		  tp->t_flags |= TF_WASFRECOVERY;
505 		else
506 		  tp->t_flags &= ~TF_WASFRECOVERY;
507 		tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
508 	}
509 	TCPSTAT_INC(tcps_rexmttimeo);
510 	if (tp->t_state == TCPS_SYN_SENT)
511 		rexmt = TCP_REXMTVAL(tp) * tcp_syn_backoff[tp->t_rxtshift];
512 	else
513 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
514 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
515 		      tp->t_rttmin, TCPTV_REXMTMAX);
516 	/*
517 	 * Disable rfc1323 if we havn't got any response to
518 	 * our third SYN to work-around some broken terminal servers
519 	 * (most of which have hopefully been retired) that have bad VJ
520 	 * header compression code which trashes TCP segments containing
521 	 * unknown-to-them TCP options.
522 	 */
523 	if ((tp->t_state == TCPS_SYN_SENT) && (tp->t_rxtshift == 3))
524 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP);
525 	/*
526 	 * If we backed off this far, our srtt estimate is probably bogus.
527 	 * Clobber it so we'll take the next rtt measurement as our srtt;
528 	 * move the current srtt into rttvar to keep the current
529 	 * retransmit times until then.
530 	 */
531 	if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) {
532 #ifdef INET6
533 		if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
534 			in6_losing(tp->t_inpcb);
535 		else
536 #endif
537 		tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT);
538 		tp->t_srtt = 0;
539 	}
540 	tp->snd_nxt = tp->snd_una;
541 	tp->snd_recover = tp->snd_max;
542 	/*
543 	 * Force a segment to be sent.
544 	 */
545 	tp->t_flags |= TF_ACKNOW;
546 	/*
547 	 * If timing a segment in this window, stop the timer.
548 	 */
549 	tp->t_rtttime = 0;
550 	/*
551 	 * Close the congestion window down to one segment
552 	 * (we'll open it by one segment for each ack we get).
553 	 * Since we probably have a window's worth of unacked
554 	 * data accumulated, this "slow start" keeps us from
555 	 * dumping all that data as back-to-back packets (which
556 	 * might overwhelm an intermediate gateway).
557 	 *
558 	 * There are two phases to the opening: Initially we
559 	 * open by one mss on each ack.  This makes the window
560 	 * size increase exponentially with time.  If the
561 	 * window is larger than the path can handle, this
562 	 * exponential growth results in dropped packet(s)
563 	 * almost immediately.  To get more time between
564 	 * drops but still "push" the network to take advantage
565 	 * of improving conditions, we switch from exponential
566 	 * to linear window opening at some threshhold size.
567 	 * For a threshhold, we use half the current window
568 	 * size, truncated to a multiple of the mss.
569 	 *
570 	 * (the minimum cwnd that will give us exponential
571 	 * growth is 2 mss.  We don't allow the threshhold
572 	 * to go below this.)
573 	 */
574 	{
575 		u_int win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg;
576 		if (win < 2)
577 			win = 2;
578 		tp->snd_cwnd = tp->t_maxseg;
579 		tp->snd_ssthresh = win * tp->t_maxseg;
580 		tp->t_dupacks = 0;
581 	}
582 	EXIT_FASTRECOVERY(tp);
583 	tp->t_bytes_acked = 0;
584 	(void) tcp_output(tp);
585 
586 out:
587 #ifdef TCPDEBUG
588 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
589 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
590 			  PRU_SLOWTIMO);
591 #endif
592 	if (tp != NULL)
593 		INP_WUNLOCK(inp);
594 	if (headlocked)
595 		INP_INFO_WUNLOCK(&V_tcbinfo);
596 	CURVNET_RESTORE();
597 }
598 
599 void
600 tcp_timer_activate(struct tcpcb *tp, int timer_type, u_int delta)
601 {
602 	struct callout *t_callout;
603 	void *f_callout;
604 
605 	switch (timer_type) {
606 		case TT_DELACK:
607 			t_callout = &tp->t_timers->tt_delack;
608 			f_callout = tcp_timer_delack;
609 			break;
610 		case TT_REXMT:
611 			t_callout = &tp->t_timers->tt_rexmt;
612 			f_callout = tcp_timer_rexmt;
613 			break;
614 		case TT_PERSIST:
615 			t_callout = &tp->t_timers->tt_persist;
616 			f_callout = tcp_timer_persist;
617 			break;
618 		case TT_KEEP:
619 			t_callout = &tp->t_timers->tt_keep;
620 			f_callout = tcp_timer_keep;
621 			break;
622 		case TT_2MSL:
623 			t_callout = &tp->t_timers->tt_2msl;
624 			f_callout = tcp_timer_2msl;
625 			break;
626 		default:
627 			panic("bad timer_type");
628 		}
629 	if (delta == 0) {
630 		callout_stop(t_callout);
631 	} else {
632 		callout_reset(t_callout, delta, f_callout, tp);
633 	}
634 }
635 
636 int
637 tcp_timer_active(struct tcpcb *tp, int timer_type)
638 {
639 	struct callout *t_callout;
640 
641 	switch (timer_type) {
642 		case TT_DELACK:
643 			t_callout = &tp->t_timers->tt_delack;
644 			break;
645 		case TT_REXMT:
646 			t_callout = &tp->t_timers->tt_rexmt;
647 			break;
648 		case TT_PERSIST:
649 			t_callout = &tp->t_timers->tt_persist;
650 			break;
651 		case TT_KEEP:
652 			t_callout = &tp->t_timers->tt_keep;
653 			break;
654 		case TT_2MSL:
655 			t_callout = &tp->t_timers->tt_2msl;
656 			break;
657 		default:
658 			panic("bad timer_type");
659 		}
660 	return callout_active(t_callout);
661 }
662 
663 #define	ticks_to_msecs(t)	(1000*(t) / hz)
664 
665 void
666 tcp_timer_to_xtimer(struct tcpcb *tp, struct tcp_timer *timer, struct xtcp_timer *xtimer)
667 {
668 	bzero(xtimer, sizeof(struct xtcp_timer));
669 	if (timer == NULL)
670 		return;
671 	if (callout_active(&timer->tt_delack))
672 		xtimer->tt_delack = ticks_to_msecs(timer->tt_delack.c_time - ticks);
673 	if (callout_active(&timer->tt_rexmt))
674 		xtimer->tt_rexmt = ticks_to_msecs(timer->tt_rexmt.c_time - ticks);
675 	if (callout_active(&timer->tt_persist))
676 		xtimer->tt_persist = ticks_to_msecs(timer->tt_persist.c_time - ticks);
677 	if (callout_active(&timer->tt_keep))
678 		xtimer->tt_keep = ticks_to_msecs(timer->tt_keep.c_time - ticks);
679 	if (callout_active(&timer->tt_2msl))
680 		xtimer->tt_2msl = ticks_to_msecs(timer->tt_2msl.c_time - ticks);
681 	xtimer->t_rcvtime = ticks_to_msecs(ticks - tp->t_rcvtime);
682 }
683