/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 */

#include <sys/types.h>

#include <sys/strlog.h>

#include <sys/strsun.h>

#include <sys/squeue_impl.h>

#include <sys/squeue.h>

#include <sys/callo.h>

#include <sys/strsubr.h>

#include <inet/common.h>

#include <inet/ip.h>

#include <inet/ip_ire.h>

#include <inet/ip_rts.h>

#include <inet/tcp.h>

#include <inet/tcp_impl.h>

/*

 * Implementation of TCP Timers.

 * =============================

 *

 * INTERFACE:

 *

 * There are two basic functions dealing with tcp timers:

 *

 *	timeout_id_t	tcp_timeout(connp, func, time)

 * 	clock_t		tcp_timeout_cancel(connp, timeout_id)

 *	TCP_TIMER_RESTART(tcp, intvl)

 *

 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func'

 * after 'time' ticks passed. The function called by timeout() must adhere to

 * the same restrictions as a driver soft interrupt handler - it must not sleep

 * or call other functions that might sleep. The value returned is the opaque

 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to

 * cancel the request. The call to tcp_timeout() may fail in which case it

 * returns zero. This is different from the timeout(9F) function which never

 * fails.

 *

 * The call-back function 'func' always receives 'connp' as its single

 * argument. It is always executed in the squeue corresponding to the tcp

 * structure. The tcp structure is guaranteed to be present at the time the

 * call-back is called.

 *

 * NOTE: The call-back function 'func' is never called if tcp is in

 * 	the TCPS_CLOSED state.

 *

 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout()

 * request. locks acquired by the call-back routine should not be held across

 * the call to tcp_timeout_cancel() or a deadlock may result.

 *

 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request.

 * Otherwise, it returns an integer value greater than or equal to 0. In

 * particular, if the call-back function is already placed on the squeue, it can

 * not be canceled.

 *

 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called

 * 	within squeue context corresponding to the tcp instance. Since the

 *	call-back is also called via the same squeue, there are no race

 *	conditions described in untimeout(9F) manual page since all calls are

 *	strictly serialized.

 *

 *      TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout

 *	stored in tcp_timer_tid and starts a new one using

 *	MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back

 *	and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid

 *	field.

 *

 * NOTE: since the timeout cancellation is not guaranteed, the cancelled

 *	call-back may still be called, so it is possible tcp_timer() will be

 *	called several times. This should not be a problem since tcp_timer()

 *	should always check the tcp instance state.

 *

 *

 * IMPLEMENTATION:

 *

 * TCP timers are implemented using three-stage process. The call to

 * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function

 * when the timer expires. The tcp_timer_callback() arranges the call of the

 * tcp_timer_handler() function via squeue corresponding to the tcp

 * instance. The tcp_timer_handler() calls actual requested timeout call-back

 * and passes tcp instance as an argument to it. Information is passed between

 * stages using the tcp_timer_t structure which contains the connp pointer, the

 * tcp call-back to call and the timeout id returned by the timeout(9F).

 *

 * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t -

 * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo

 * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout()

 * returns the pointer to this mblk.

 *

 * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It

 * looks like a normal mblk without actual dblk attached to it.

 *

 * To optimize performance each tcp instance holds a small cache of timer

 * mblocks. In the current implementation it caches up to two timer mblocks per

 * tcp instance. The cache is preserved over tcp frees and is only freed when

 * the whole tcp structure is destroyed by its kmem destructor. Since all tcp

 * timer processing happens on a corresponding squeue, the cache manipulation

 * does not require any locks. Experiments show that majority of timer mblocks

 * allocations are satisfied from the tcp cache and do not involve kmem calls.

 *

 * The tcp_timeout() places a refhold on the connp instance which guarantees

 * that it will be present at the time the call-back function fires. The

 * tcp_timer_handler() drops the reference after calling the call-back, so the

 * call-back function does not need to manipulate the references explicitly.

 */

kmem_cache_t *tcp_timercache;

static void	tcp_ip_notify(tcp_t *);

static void	tcp_timer_callback(void *);

static void	tcp_timer_free(tcp_t *, mblk_t *);

static void	tcp_timer_handler(void *, mblk_t *, void *, ip_recv_attr_t *);

timeout_id_t

{

	mblk_t *mp;

	tcp_timer_t *tcpt;

	tcp_t *tcp = connp->conn_tcp;

	ASSERT(connp->conn_sqp != NULL);

	TCP_DBGSTAT(tcp->tcp_tcps, tcp_timeout_calls);

	if (tcp->tcp_timercache == NULL) {

		mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC);

	} else {

		TCP_DBGSTAT(tcp->tcp_tcps, tcp_timeout_cached_alloc);

		mp = tcp->tcp_timercache;

		tcp->tcp_timercache = mp->b_next;

		mp->b_next = NULL;

		ASSERT(mp->b_wptr == NULL);

	}

	CONN_INC_REF(connp);

	tcpt = (tcp_timer_t *)mp->b_rptr;

	tcpt->connp = connp;

	tcpt->tcpt_proc = f;

	/*

	 * TCP timers are normal timeouts. Plus, they do not require more than

	 * a 10 millisecond resolution. By choosing a coarser resolution and by

	 * rounding up the expiration to the next resolution boundary, we can

	 * batch timers in the callout subsystem to make TCP timers more

	 * efficient. The roundup also protects short timers from expiring too

	 * early before they have a chance to be cancelled.

	 */

	tcpt->tcpt_tid = timeout_generic(CALLOUT_NORMAL, tcp_timer_callback, mp,

	return ((timeout_id_t)mp);

}

static void

tcp_timer_callback(void *arg)

{

	mblk_t *mp = (mblk_t *)arg;

	tcp_timer_t *tcpt;

	conn_t	*connp;

	tcpt = (tcp_timer_t *)mp->b_rptr;

	connp = tcpt->connp;

	SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_timer_handler, connp,

	    NULL, SQ_FILL, SQTAG_TCP_TIMER);

}

/* ARGSUSED */

static void

tcp_timer_handler(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)

{

	tcp_timer_t *tcpt;

	conn_t *connp = (conn_t *)arg;

	tcp_t *tcp = connp->conn_tcp;

	tcpt = (tcp_timer_t *)mp->b_rptr;

	ASSERT(connp == tcpt->connp);

	ASSERT((squeue_t *)arg2 == connp->conn_sqp);

	/*

	 * If the TCP has reached the closed state, don't proceed any

	 * further. This TCP logically does not exist on the system.

	 * tcpt_proc could for example access queues, that have already

	 * been qprocoff'ed off.

	 */

	if (tcp->tcp_state != TCPS_CLOSED) {

		(*tcpt->tcpt_proc)(connp);

	} else {

		tcp->tcp_timer_tid = 0;

	}

	tcp_timer_free(connp->conn_tcp, mp);

}

/*

 * There is potential race with untimeout and the handler firing at the same

 * time. The mblock may be freed by the handler while we are trying to use

 * it. But since both should execute on the same squeue, this race should not

 * occur.

 */

clock_t

tcp_timeout_cancel(conn_t *connp, timeout_id_t id)

{

	mblk_t	*mp = (mblk_t *)id;

	tcp_timer_t *tcpt;

	clock_t delta;

	TCP_DBGSTAT(connp->conn_tcp->tcp_tcps, tcp_timeout_cancel_reqs);

	if (mp == NULL)

		return (-1);

	tcpt = (tcp_timer_t *)mp->b_rptr;

	ASSERT(tcpt->connp == connp);

	delta = untimeout_default(tcpt->tcpt_tid, 0);

	if (delta >= 0) {

		TCP_DBGSTAT(connp->conn_tcp->tcp_tcps, tcp_timeout_canceled);

		tcp_timer_free(connp->conn_tcp, mp);

		CONN_DEC_REF(connp);

	}

}

/*

 * Allocate space for the timer event. The allocation looks like mblk, but it is

 * not a proper mblk. To avoid confusion we set b_wptr to NULL.

 *

 * Dealing with failures: If we can't allocate from the timer cache we try

 * allocating from dblock caches using allocb_tryhard(). In this case b_wptr

 * points to b_rptr.

 * If we can't allocate anything using allocb_tryhard(), we perform a last

 * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and

 * save the actual allocation size in b_datap.

 */

mblk_t *

tcp_timermp_alloc(int kmflags)

{

	mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache,

	    kmflags & ~KM_PANIC);

	if (mp != NULL) {

		mp->b_next = mp->b_prev = NULL;

		mp->b_rptr = (uchar_t *)(&mp[1]);

		mp->b_wptr = NULL;

		mp->b_datap = NULL;

		mp->b_queue = NULL;

		mp->b_cont = NULL;

	} else if (kmflags & KM_PANIC) {

		/*

		 * Failed to allocate memory for the timer. Try allocating from

		 * dblock caches.

		 */

		/* ipclassifier calls this from a constructor - hence no tcps */

		TCP_G_STAT(tcp_timermp_allocfail);

		mp = allocb_tryhard(sizeof (tcp_timer_t));

		if (mp == NULL) {

			size_t size = 0;

			/*

			 * Memory is really low. Try tryhard allocation.

			 *

			 * ipclassifier calls this from a constructor -

			 * hence no tcps

			 */

			TCP_G_STAT(tcp_timermp_allocdblfail);

			mp = kmem_alloc_tryhard(sizeof (mblk_t) +

			    sizeof (tcp_timer_t), &size, kmflags);

			mp->b_rptr = (uchar_t *)(&mp[1]);

			mp->b_next = mp->b_prev = NULL;

			mp->b_wptr = (uchar_t *)-1;

			mp->b_datap = (dblk_t *)size;

			mp->b_queue = NULL;

			mp->b_cont = NULL;

		}

		ASSERT(mp->b_wptr != NULL);

	}

	/* ipclassifier calls this from a constructor - hence no tcps */

	TCP_G_DBGSTAT(tcp_timermp_alloced);

	return (mp);

}

/*

 * Free per-tcp timer cache.

 * It can only contain entries from tcp_timercache.

 */

void

tcp_timermp_free(tcp_t *tcp)

{

	mblk_t *mp;

	while ((mp = tcp->tcp_timercache) != NULL) {

		ASSERT(mp->b_wptr == NULL);

		tcp->tcp_timercache = tcp->tcp_timercache->b_next;

		kmem_cache_free(tcp_timercache, mp);

	}

}

/*

 * Free timer event. Put it on the per-tcp timer cache if there is not too many

 * events there already (currently at most two events are cached).

 * If the event is not allocated from the timer cache, free it right away.

 */

static void

tcp_timer_free(tcp_t *tcp, mblk_t *mp)

{

	mblk_t *mp1 = tcp->tcp_timercache;

	if (mp->b_wptr != NULL) {

		/*

		 * This allocation is not from a timer cache, free it right

		 * away.

		 */

		if (mp->b_wptr != (uchar_t *)-1)

			freeb(mp);

		else

			kmem_free(mp, (size_t)mp->b_datap);

	} else if (mp1 == NULL || mp1->b_next == NULL) {

		/* Cache this timer block for future allocations */

		mp->b_rptr = (uchar_t *)(&mp[1]);

		mp->b_next = mp1;

		tcp->tcp_timercache = mp;

	} else {

		kmem_cache_free(tcp_timercache, mp);

		TCP_DBGSTAT(tcp->tcp_tcps, tcp_timermp_freed);

	}

}

/*

 * Stop all TCP timers.

 */

void

tcp_timers_stop(tcp_t *tcp)

{

	if (tcp->tcp_timer_tid != 0) {

		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);

		tcp->tcp_timer_tid = 0;

	}

	if (tcp->tcp_ka_tid != 0) {

		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid);

		tcp->tcp_ka_tid = 0;

	}

	if (tcp->tcp_ack_tid != 0) {

		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);

		tcp->tcp_ack_tid = 0;

	}

	if (tcp->tcp_push_tid != 0) {

		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);

		tcp->tcp_push_tid = 0;

	}

	if (tcp->tcp_reass_tid != 0) {

		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_reass_tid);

		tcp->tcp_reass_tid = 0;

	}

}

/*

 * Timer callback routine for keepalive probe.  We do a fake resend of

 * last ACKed byte.  Then set a timer using RTO.  When the timer expires,

 * check to see if we have heard anything from the other end for the last

 * RTO period.  If we have, set the timer to expire for another

 * tcp_keepalive_intrvl and check again.  If we have not, set a timer using

 * RTO << 1 and check again when it expires.  Keep exponentially increasing

 * the timeout if we have not heard from the other side.  If for more than

 * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything,

 * kill the connection unless the keepalive abort threshold is 0.  In

 * that case, we will probe "forever."

 */

void

tcp_keepalive_timer(void *arg)

{

	mblk_t	*mp;

	conn_t	*connp = (conn_t *)arg;

	tcp_t  	*tcp = connp->conn_tcp;

	int32_t	firetime;

	int32_t	idletime;

	int32_t	ka_intrvl;

	tcp_stack_t	*tcps = tcp->tcp_tcps;

	tcp->tcp_ka_tid = 0;

	if (tcp->tcp_fused)

		return;

	TCPS_BUMP_MIB(tcps, tcpTimKeepalive);

	ka_intrvl = tcp->tcp_ka_interval;

	/*

	 * Keepalive probe should only be sent if the application has not

	 * done a close on the connection.

	 */

	if (tcp->tcp_state > TCPS_CLOSE_WAIT) {

		return;

	}

	/* Timer fired too early, restart it. */

	if (tcp->tcp_state < TCPS_ESTABLISHED) {

		tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_timer,

		return;

	}

	idletime = TICK_TO_MSEC(ddi_get_lbolt() - tcp->tcp_last_recv_time);

	/*

	 * If we have not heard from the other side for a long

	 * time, kill the connection unless the keepalive abort

	 * threshold is 0.  In that case, we will probe "forever."

	 */

	if (tcp->tcp_ka_abort_thres != 0 &&

	    idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) {

		TCPS_BUMP_MIB(tcps, tcpTimKeepaliveDrop);

		(void) tcp_clean_death(tcp, tcp->tcp_client_errno ?

		    tcp->tcp_client_errno : ETIMEDOUT);

		return;

	}

	if (tcp->tcp_snxt == tcp->tcp_suna &&

	    idletime >= ka_intrvl) {

		/* Fake resend of last ACKed byte. */

		mblk_t	*mp1 = allocb(1, BPRI_LO);

		if (mp1 != NULL) {

			*mp1->b_wptr++ = '\0';

			mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL,

			    tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE);

			freeb(mp1);

			/*

			 * if allocation failed, fall through to start the

			 * timer back.

			 */

			if (mp != NULL) {

				tcp_send_data(tcp, mp);

				TCPS_BUMP_MIB(tcps, tcpTimKeepaliveProbe);

				if (tcp->tcp_ka_last_intrvl != 0) {

					int max;

					/*

					 * We should probe again at least

					 * in ka_intrvl, but not more than

					 * tcp_rexmit_interval_max.

					 */

					max = tcps->tcps_rexmit_interval_max;

					firetime = MIN(ka_intrvl - 1,

					    tcp->tcp_ka_last_intrvl << 1);

					if (firetime > max)

						firetime = max;

				} else {

					firetime = tcp->tcp_rto;

				}

				tcp->tcp_ka_tid = TCP_TIMER(tcp,

				tcp->tcp_ka_last_intrvl = firetime;

				return;

			}

		}

	} else {

		tcp->tcp_ka_last_intrvl = 0;

	}

	/* firetime can be negative if (mp1 == NULL || mp == NULL) */

	if ((firetime = ka_intrvl - idletime) < 0) {

		firetime = ka_intrvl;

	}

}

void

tcp_reass_timer(void *arg)

{

	conn_t *connp = (conn_t *)arg;

	tcp_t *tcp = connp->conn_tcp;

	tcp->tcp_reass_tid = 0;

	if (tcp->tcp_reass_head == NULL)

		return;

	ASSERT(tcp->tcp_reass_tail != NULL);

	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {

		tcp_sack_remove(tcp->tcp_sack_list,

		    TCP_REASS_END(tcp->tcp_reass_tail), &tcp->tcp_num_sack_blk);

	}

	tcp_close_mpp(&tcp->tcp_reass_head);

	tcp->tcp_reass_tail = NULL;

	TCP_STAT(tcp->tcp_tcps, tcp_reass_timeout);

}

/* This function handles the push timeout. */

void

tcp_push_timer(void *arg)

{

	conn_t	*connp = (conn_t *)arg;

	tcp_t *tcp = connp->conn_tcp;

	TCP_DBGSTAT(tcp->tcp_tcps, tcp_push_timer_cnt);

	ASSERT(tcp->tcp_listener == NULL);

	ASSERT(!IPCL_IS_NONSTR(connp));

	tcp->tcp_push_tid = 0;

	if (tcp->tcp_rcv_list != NULL &&

	    tcp_rcv_drain(tcp) == TH_ACK_NEEDED)

		tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);

}