sys/netinet/tcp_timer.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 4. Neither the name of the University nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  *      @(#)tcp_timer.c 8.2 (Berkeley) 5/24/95
  30  * $FreeBSD$
  31  */
  32
  33 #include "opt_inet6.h"
  34 #include "opt_tcpdebug.h"
  35 #include "opt_tcp_sack.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/kernel.h>
  39 #include <sys/lock.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/mutex.h>
  42 #include <sys/protosw.h>
  43 #include <sys/socket.h>
  44 #include <sys/socketvar.h>
  45 #include <sys/sysctl.h>
  46 #include <sys/systm.h>
  47
  48 #include <net/route.h>
  49
  50 #include <netinet/in.h>
  51 #include <netinet/in_pcb.h>
  52 #include <netinet/in_systm.h>
  53 #ifdef INET6
  54 #include <netinet6/in6_pcb.h>
  55 #endif
  56 #include <netinet/ip_var.h>
  57 #include <netinet/tcp.h>
  58 #include <netinet/tcp_fsm.h>
  59 #include <netinet/tcp_timer.h>
  60 #include <netinet/tcp_var.h>
  61 #include <netinet/tcpip.h>
  62 #ifdef TCPDEBUG
  63 #include <netinet/tcp_debug.h>
  64 #endif
  65
  66 int     tcp_keepinit;
  67 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT|CTLFLAG_RW,
  68     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "");
  69
  70 int     tcp_keepidle;
  71 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT|CTLFLAG_RW,
  72     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "");
  73
  74 int     tcp_keepintvl;
  75 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT|CTLFLAG_RW,
  76     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "");
  77
  78 int     tcp_delacktime;
  79 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime,
  80     CTLTYPE_INT|CTLFLAG_RW, &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
  81     "Time before a delayed ACK is sent");
  82
  83 int     tcp_msl;
  84 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT|CTLFLAG_RW,
  85     &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
  86
  87 int     tcp_rexmit_min;
  88 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT|CTLFLAG_RW,
  89     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I", "Minimum Retransmission Timeout");
  90
  91 int     tcp_rexmit_slop;
  92 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT|CTLFLAG_RW,
  93     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I", "Retransmission Timer Slop");
  94
  95 static int      always_keepalive = 1;
  96 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_RW,
  97     &always_keepalive , 0, "Assume SO_KEEPALIVE on all TCP connections");
  98
  99 int    tcp_fast_finwait2_recycle = 0;
 100 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
 101            &tcp_fast_finwait2_recycle, 0, "Recycle closed FIN_WAIT_2 connections faster");
 102
 103 int    tcp_finwait2_timeout;
 104 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT|CTLFLAG_RW,
 105             &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "");
 106
 107
 108 static int      tcp_keepcnt = TCPTV_KEEPCNT;
 109         /* max idle probes */
 110 int     tcp_maxpersistidle;
 111         /* max idle time in persist */
 112 int     tcp_maxidle;
 113
 114 /*
 115  * Tcp protocol timeout routine called every 500 ms.
 116  * Updates timestamps used for TCP
 117  * causes finite state machine actions if timers expire.
 118  */
 119 void
 120 tcp_slowtimo()
 121 {
 122
 123         tcp_maxidle = tcp_keepcnt * tcp_keepintvl;
 124         INP_INFO_WLOCK(&tcbinfo);
 125         (void) tcp_timer_2msl_tw(0);
 126         INP_INFO_WUNLOCK(&tcbinfo);
 127 }
 128
 129 int     tcp_syn_backoff[TCP_MAXRXTSHIFT + 1] =
 130     { 1, 1, 1, 1, 1, 2, 4, 8, 16, 32, 64, 64, 64 };
 131
 132 int     tcp_backoff[TCP_MAXRXTSHIFT + 1] =
 133     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
 134
 135 static int tcp_totbackoff = 2559;       /* sum of tcp_backoff[] */
 136
 137 static int tcp_timer_race;
 138 SYSCTL_INT(_net_inet_tcp, OID_AUTO, timer_race, CTLFLAG_RD, &tcp_timer_race,
 139     0, "Count of t_inpcb races on tcp_discardcb");
 140
 141 /*
 142  * TCP timer processing.
 143  */
 144
 145 void
 146 tcp_timer_delack(xtp)
 147         void *xtp;
 148 {
 149         struct tcpcb *tp = xtp;
 150         struct inpcb *inp;
 151
 152         INP_INFO_RLOCK(&tcbinfo);
 153         inp = tp->t_inpcb;
 154         /*
 155          * XXXRW: While this assert is in fact correct, bugs in the tcpcb
 156          * tear-down mean we need it as a work-around for races between
 157          * timers and tcp_discardcb().
 158          *
 159          * KASSERT(inp != NULL, ("tcp_timer_delack: inp == NULL"));
 160          */
 161         if (inp == NULL) {
 162                 tcp_timer_race++;
 163                 INP_INFO_RUNLOCK(&tcbinfo);
 164                 return;
 165         }
 166         INP_LOCK(inp);
 167         INP_INFO_RUNLOCK(&tcbinfo);
 168         if ((inp->inp_vflag & INP_DROPPED) || callout_pending(tp->tt_delack)
 169             || !callout_active(tp->tt_delack)) {
 170                 INP_UNLOCK(inp);
 171                 return;
 172         }
 173         callout_deactivate(tp->tt_delack);
 174
 175         tp->t_flags |= TF_ACKNOW;
 176         tcpstat.tcps_delack++;
 177         (void) tcp_output(tp);
 178         INP_UNLOCK(inp);
 179 }
 180
 181 void
 182 tcp_timer_2msl(xtp)
 183         void *xtp;
 184 {
 185         struct tcpcb *tp = xtp;
 186         struct inpcb *inp;
 187 #ifdef TCPDEBUG
 188         int ostate;
 189
 190         ostate = tp->t_state;
 191 #endif
 192         /*
 193          * XXXRW: Does this actually happen?
 194          */
 195         INP_INFO_WLOCK(&tcbinfo);
 196         inp = tp->t_inpcb;
 197         /*
 198          * XXXRW: While this assert is in fact correct, bugs in the tcpcb
 199          * tear-down mean we need it as a work-around for races between
 200          * timers and tcp_discardcb().
 201          *
 202          * KASSERT(inp != NULL, ("tcp_timer_2msl: inp == NULL"));
 203          */
 204         if (inp == NULL) {
 205                 tcp_timer_race++;
 206                 INP_INFO_WUNLOCK(&tcbinfo);
 207                 return;
 208         }
 209         INP_LOCK(inp);
 210         tcp_free_sackholes(tp);
 211         if ((inp->inp_vflag & INP_DROPPED) || callout_pending(tp->tt_2msl) ||
 212             !callout_active(tp->tt_2msl)) {
 213                 INP_UNLOCK(tp->t_inpcb);
 214                 INP_INFO_WUNLOCK(&tcbinfo);
 215                 return;
 216         }
 217         callout_deactivate(tp->tt_2msl);
 218         /*
 219          * 2 MSL timeout in shutdown went off.  If we're closed but
 220          * still waiting for peer to close and connection has been idle
 221          * too long, or if 2MSL time is up from TIME_WAIT, delete connection
 222          * control block.  Otherwise, check again in a bit.
 223          *
 224          * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
 225          * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
 226          * Ignore fact that there were recent incoming segments.
 227          */
 228         if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
 229             tp->t_inpcb && tp->t_inpcb->inp_socket &&
 230             (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
 231                 tcpstat.tcps_finwait2_drops++;
 232                 tp = tcp_close(tp);
 233         } else {
 234                 if (tp->t_state != TCPS_TIME_WAIT &&
 235                    (ticks - tp->t_rcvtime) <= tcp_maxidle)
 236                        callout_reset(tp->tt_2msl, tcp_keepintvl,
 237                                      tcp_timer_2msl, tp);
 238                else
 239                        tp = tcp_close(tp);
 240        }
 241
 242 #ifdef TCPDEBUG
 243         if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
 244                 tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
 245                           PRU_SLOWTIMO);
 246 #endif
 247         if (tp != NULL)
 248                 INP_UNLOCK(inp);
 249         INP_INFO_WUNLOCK(&tcbinfo);
 250 }
 251
 252 /*
 253  * The timed wait queue contains references to each of the TCP sessions
 254  * currently in the TIME_WAIT state.  The queue pointers, including the
 255  * queue pointers in each tcptw structure, are protected using the global
 256  * tcbinfo lock, which must be held over queue iteration and modification.
 257  */
 258 static TAILQ_HEAD(, tcptw)      twq_2msl;
 259
 260 void
 261 tcp_timer_init(void)
 262 {
 263
 264         TAILQ_INIT(&twq_2msl);
 265 }
 266
 267 void
 268 tcp_timer_2msl_reset(struct tcptw *tw, int rearm)
 269 {
 270
 271         INP_INFO_WLOCK_ASSERT(&tcbinfo);
 272         INP_LOCK_ASSERT(tw->tw_inpcb);
 273         if (rearm)
 274                 TAILQ_REMOVE(&twq_2msl, tw, tw_2msl);
 275         tw->tw_time = ticks + 2 * tcp_msl;
 276         TAILQ_INSERT_TAIL(&twq_2msl, tw, tw_2msl);
 277 }
 278
 279 void
 280 tcp_timer_2msl_stop(struct tcptw *tw)
 281 {
 282
 283         INP_INFO_WLOCK_ASSERT(&tcbinfo);
 284         TAILQ_REMOVE(&twq_2msl, tw, tw_2msl);
 285 }
 286
 287 struct tcptw *
 288 tcp_timer_2msl_tw(int reuse)
 289 {
 290         struct tcptw *tw;
 291
 292         INP_INFO_WLOCK_ASSERT(&tcbinfo);
 293         for (;;) {
 294                 tw = TAILQ_FIRST(&twq_2msl);
 295                 if (tw == NULL || (!reuse && tw->tw_time > ticks))
 296                         break;
 297                 INP_LOCK(tw->tw_inpcb);
 298                 tcp_twclose(tw, reuse);
 299                 if (reuse)
 300                         return (tw);
 301         }
 302         return (NULL);
 303 }
 304
 305 void
 306 tcp_timer_keep(xtp)
 307         void *xtp;
 308 {
 309         struct tcpcb *tp = xtp;
 310         struct tcptemp *t_template;
 311         struct inpcb *inp;
 312 #ifdef TCPDEBUG
 313         int ostate;
 314
 315         ostate = tp->t_state;
 316 #endif
 317         INP_INFO_WLOCK(&tcbinfo);
 318         inp = tp->t_inpcb;
 319         /*
 320          * XXXRW: While this assert is in fact correct, bugs in the tcpcb
 321          * tear-down mean we need it as a work-around for races between
 322          * timers and tcp_discardcb().
 323          *
 324          * KASSERT(inp != NULL, ("tcp_timer_keep: inp == NULL"));
 325          */
 326         if (inp == NULL) {
 327                 tcp_timer_race++;
 328                 INP_INFO_WUNLOCK(&tcbinfo);
 329                 return;
 330         }
 331         INP_LOCK(inp);
 332         if ((inp->inp_vflag & INP_DROPPED) || callout_pending(tp->tt_keep)
 333             || !callout_active(tp->tt_keep)) {
 334                 INP_UNLOCK(inp);
 335                 INP_INFO_WUNLOCK(&tcbinfo);
 336                 return;
 337         }
 338         callout_deactivate(tp->tt_keep);
 339         /*
 340          * Keep-alive timer went off; send something
 341          * or drop connection if idle for too long.
 342          */
 343         tcpstat.tcps_keeptimeo++;
 344         if (tp->t_state < TCPS_ESTABLISHED)
 345                 goto dropit;
 346         if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
 347             tp->t_state <= TCPS_CLOSING) {
 348                 if ((ticks - tp->t_rcvtime) >= tcp_keepidle + tcp_maxidle)
 349                         goto dropit;
 350                 /*
 351                  * Send a packet designed to force a response
 352                  * if the peer is up and reachable:
 353                  * either an ACK if the connection is still alive,
 354                  * or an RST if the peer has closed the connection
 355                  * due to timeout or reboot.
 356                  * Using sequence number tp->snd_una-1
 357                  * causes the transmitted zero-length segment
 358                  * to lie outside the receive window;
 359                  * by the protocol spec, this requires the
 360                  * correspondent TCP to respond.
 361                  */
 362                 tcpstat.tcps_keepprobe++;
 363                 t_template = tcpip_maketemplate(inp);
 364                 if (t_template) {
 365                         tcp_respond(tp, t_template->tt_ipgen,
 366                                     &t_template->tt_t, (struct mbuf *)NULL,
 367                                     tp->rcv_nxt, tp->snd_una - 1, 0);
 368                         (void) m_free(dtom(t_template));
 369                 }
 370                 callout_reset(tp->tt_keep, tcp_keepintvl, tcp_timer_keep, tp);
 371         } else
 372                 callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
 373
 374 #ifdef TCPDEBUG
 375         if (inp->inp_socket->so_options & SO_DEBUG)
 376                 tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
 377                           PRU_SLOWTIMO);
 378 #endif
 379         INP_UNLOCK(inp);
 380         INP_INFO_WUNLOCK(&tcbinfo);
 381         return;
 382
 383 dropit:
 384         tcpstat.tcps_keepdrops++;
 385         tp = tcp_drop(tp, ETIMEDOUT);
 386
 387 #ifdef TCPDEBUG
 388         if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
 389                 tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
 390                           PRU_SLOWTIMO);
 391 #endif
 392         if (tp != NULL)
 393                 INP_UNLOCK(tp->t_inpcb);
 394         INP_INFO_WUNLOCK(&tcbinfo);
 395 }
 396
 397 void
 398 tcp_timer_persist(xtp)
 399         void *xtp;
 400 {
 401         struct tcpcb *tp = xtp;
 402         struct inpcb *inp;
 403 #ifdef TCPDEBUG
 404         int ostate;
 405
 406         ostate = tp->t_state;
 407 #endif
 408         INP_INFO_WLOCK(&tcbinfo);
 409         inp = tp->t_inpcb;
 410         /*
 411          * XXXRW: While this assert is in fact correct, bugs in the tcpcb
 412          * tear-down mean we need it as a work-around for races between
 413          * timers and tcp_discardcb().
 414          *
 415          * KASSERT(inp != NULL, ("tcp_timer_persist: inp == NULL"));
 416          */
 417         if (inp == NULL) {
 418                 tcp_timer_race++;
 419                 INP_INFO_WUNLOCK(&tcbinfo);
 420                 return;
 421         }
 422         INP_LOCK(inp);
 423         if ((inp->inp_vflag & INP_DROPPED) || callout_pending(tp->tt_persist)
 424             || !callout_active(tp->tt_persist)) {
 425                 INP_UNLOCK(inp);
 426                 INP_INFO_WUNLOCK(&tcbinfo);
 427                 return;
 428         }
 429         callout_deactivate(tp->tt_persist);
 430         /*
 431          * Persistance timer into zero window.
 432          * Force a byte to be output, if possible.
 433          */
 434         tcpstat.tcps_persisttimeo++;
 435         /*
 436          * Hack: if the peer is dead/unreachable, we do not
 437          * time out if the window is closed.  After a full
 438          * backoff, drop the connection if the idle time
 439          * (no responses to probes) reaches the maximum
 440          * backoff that we would use if retransmitting.
 441          */
 442         if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
 443             ((ticks - tp->t_rcvtime) >= tcp_maxpersistidle ||
 444              (ticks - tp->t_rcvtime) >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
 445                 tcpstat.tcps_persistdrop++;
 446                 tp = tcp_drop(tp, ETIMEDOUT);
 447                 goto out;
 448         }
 449         tcp_setpersist(tp);
 450         tp->t_flags |= TF_FORCEDATA;
 451         (void) tcp_output(tp);
 452         tp->t_flags &= ~TF_FORCEDATA;
 453
 454 out:
 455 #ifdef TCPDEBUG
 456         if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
 457                 tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
 458 #endif
 459         if (tp != NULL)
 460                 INP_UNLOCK(inp);
 461         INP_INFO_WUNLOCK(&tcbinfo);
 462 }
 463
 464 void
 465 tcp_timer_rexmt(xtp)
 466         void *xtp;
 467 {
 468         struct tcpcb *tp = xtp;
 469         int rexmt;
 470         int headlocked;
 471         struct inpcb *inp;
 472 #ifdef TCPDEBUG
 473         int ostate;
 474
 475         ostate = tp->t_state;
 476 #endif
 477         INP_INFO_WLOCK(&tcbinfo);
 478         headlocked = 1;
 479         inp = tp->t_inpcb;
 480         /*
 481          * XXXRW: While this assert is in fact correct, bugs in the tcpcb
 482          * tear-down mean we need it as a work-around for races between
 483          * timers and tcp_discardcb().
 484          *
 485          * KASSERT(inp != NULL, ("tcp_timer_rexmt: inp == NULL"));
 486          */
 487         if (inp == NULL) {
 488                 tcp_timer_race++;
 489                 INP_INFO_WUNLOCK(&tcbinfo);
 490                 return;
 491         }
 492         INP_LOCK(inp);
 493         if ((inp->inp_vflag & INP_DROPPED) || callout_pending(tp->tt_rexmt)
 494             || !callout_active(tp->tt_rexmt)) {
 495                 INP_UNLOCK(inp);
 496                 INP_INFO_WUNLOCK(&tcbinfo);
 497                 return;
 498         }
 499         callout_deactivate(tp->tt_rexmt);
 500         tcp_free_sackholes(tp);
 501         /*
 502          * Retransmission timer went off.  Message has not
 503          * been acked within retransmit interval.  Back off
 504          * to a longer retransmit interval and retransmit one segment.
 505          */
 506         if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
 507                 tp->t_rxtshift = TCP_MAXRXTSHIFT;
 508                 tcpstat.tcps_timeoutdrop++;
 509                 tp = tcp_drop(tp, tp->t_softerror ?
 510                               tp->t_softerror : ETIMEDOUT);
 511                 goto out;
 512         }
 513         INP_INFO_WUNLOCK(&tcbinfo);
 514         headlocked = 0;
 515         if (tp->t_rxtshift == 1) {
 516                 /*
 517                  * first retransmit; record ssthresh and cwnd so they can
 518                  * be recovered if this turns out to be a "bad" retransmit.
 519                  * A retransmit is considered "bad" if an ACK for this
 520                  * segment is received within RTT/2 interval; the assumption
 521                  * here is that the ACK was already in flight.  See
 522                  * "On Estimating End-to-End Network Path Properties" by
 523                  * Allman and Paxson for more details.
 524                  */
 525                 tp->snd_cwnd_prev = tp->snd_cwnd;
 526                 tp->snd_ssthresh_prev = tp->snd_ssthresh;
 527                 tp->snd_recover_prev = tp->snd_recover;
 528                 if (IN_FASTRECOVERY(tp))
 529                   tp->t_flags |= TF_WASFRECOVERY;
 530                 else
 531                   tp->t_flags &= ~TF_WASFRECOVERY;
 532                 tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
 533         }
 534         tcpstat.tcps_rexmttimeo++;
 535         if (tp->t_state == TCPS_SYN_SENT)
 536                 rexmt = TCP_REXMTVAL(tp) * tcp_syn_backoff[tp->t_rxtshift];
 537         else
 538                 rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
 539         TCPT_RANGESET(tp->t_rxtcur, rexmt,
 540                       tp->t_rttmin, TCPTV_REXMTMAX);
 541         /*
 542          * Disable rfc1323 if we havn't got any response to
 543          * our third SYN to work-around some broken terminal servers
 544          * (most of which have hopefully been retired) that have bad VJ
 545          * header compression code which trashes TCP segments containing
 546          * unknown-to-them TCP options.
 547          */
 548         if ((tp->t_state == TCPS_SYN_SENT) && (tp->t_rxtshift == 3))
 549                 tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP);
 550         /*
 551          * If we backed off this far, our srtt estimate is probably bogus.
 552          * Clobber it so we'll take the next rtt measurement as our srtt;
 553          * move the current srtt into rttvar to keep the current
 554          * retransmit times until then.
 555          */
 556         if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) {
 557 #ifdef INET6
 558                 if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
 559                         in6_losing(tp->t_inpcb);
 560                 else
 561 #endif
 562                 tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT);
 563                 tp->t_srtt = 0;
 564         }
 565         tp->snd_nxt = tp->snd_una;
 566         tp->snd_recover = tp->snd_max;
 567         /*
 568          * Force a segment to be sent.
 569          */
 570         tp->t_flags |= TF_ACKNOW;
 571         /*
 572          * If timing a segment in this window, stop the timer.
 573          */
 574         tp->t_rtttime = 0;
 575         /*
 576          * Close the congestion window down to one segment
 577          * (we'll open it by one segment for each ack we get).
 578          * Since we probably have a window's worth of unacked
 579          * data accumulated, this "slow start" keeps us from
 580          * dumping all that data as back-to-back packets (which
 581          * might overwhelm an intermediate gateway).
 582          *
 583          * There are two phases to the opening: Initially we
 584          * open by one mss on each ack.  This makes the window
 585          * size increase exponentially with time.  If the
 586          * window is larger than the path can handle, this
 587          * exponential growth results in dropped packet(s)
 588          * almost immediately.  To get more time between
 589          * drops but still "push" the network to take advantage
 590          * of improving conditions, we switch from exponential
 591          * to linear window opening at some threshhold size.
 592          * For a threshhold, we use half the current window
 593          * size, truncated to a multiple of the mss.
 594          *
 595          * (the minimum cwnd that will give us exponential
 596          * growth is 2 mss.  We don't allow the threshhold
 597          * to go below this.)
 598          */
 599         {
 600                 u_int win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg;
 601                 if (win < 2)
 602                         win = 2;
 603                 tp->snd_cwnd = tp->t_maxseg;
 604                 tp->snd_ssthresh = win * tp->t_maxseg;
 605                 tp->t_dupacks = 0;
 606         }
 607         EXIT_FASTRECOVERY(tp);
 608         (void) tcp_output(tp);
 609
 610 out:
 611 #ifdef TCPDEBUG
 612         if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
 613                 tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
 614                           PRU_SLOWTIMO);
 615 #endif
 616         if (tp != NULL)
 617                 INP_UNLOCK(inp);
 618         if (headlocked)
 619                 INP_INFO_WUNLOCK(&tcbinfo);
 620 }