/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

/* Copyright (c) 1990 Mentat Inc. */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

const char tcp_version[] = "%Z%%M%	%I%	%E% SMI";

#include <sys/types.h>

#include <sys/stream.h>

#include <sys/strsun.h>

#include <sys/strsubr.h>

#include <sys/stropts.h>

#include <sys/strlog.h>

#include <sys/strsun.h>

#define	_SUN_TPI_VERSION 2

#include <sys/tihdr.h>

#include <sys/timod.h>

#include <sys/ddi.h>

#include <sys/sunddi.h>

#include <sys/suntpi.h>

#include <sys/xti_inet.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/vtrace.h>

#include <sys/kmem.h>

#include <sys/ethernet.h>

#include <sys/cpuvar.h>

#include <sys/dlpi.h>

#include <sys/multidata.h>

#include <sys/multidata_impl.h>

#include <sys/pattr.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <sys/errno.h>

#include <sys/signal.h>

#include <sys/socket.h>

#include <sys/sockio.h>

#include <sys/isa_defs.h>

#include <sys/md5.h>

#include <sys/random.h>

#include <netinet/in.h>

#include <netinet/tcp.h>

#include <netinet/ip6.h>

#include <netinet/icmp6.h>

#include <net/if.h>

#include <net/route.h>

#include <inet/ipsec_impl.h>

#include <inet/common.h>

#include <inet/ip.h>

#include <inet/ip6.h>

#include <inet/ip_ndp.h>

#include <inet/mi.h>

#include <inet/mib2.h>

#include <inet/nd.h>

#include <inet/optcom.h>

#include <inet/snmpcom.h>

#include <inet/kstatcom.h>

#include <inet/tcp.h>

#include <net/pfkeyv2.h>

#include <inet/ipsec_info.h>

#include <inet/ipdrop.h>

#include <inet/tcp_trace.h>

#include <inet/ipclassifier.h>

#include <inet/ip_ire.h>

#include <inet/ip_if.h>

#include <inet/ipp_common.h>

#include <sys/squeue.h>

/*

 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)

 *

 * (Read the detailed design doc in PSARC case directory)

 *

 * The entire tcp state is contained in tcp_t and conn_t structure

 * which are allocated in tandem using ipcl_conn_create() and passing

 * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect

 * the references on the tcp_t. The tcp_t structure is never compressed

 * and packets always land on the correct TCP perimeter from the time

 * eager is created till the time tcp_t dies (as such the old mentat

 * TCP global queue is not used for detached state and no IPSEC checking

 * is required). The global queue is still allocated to send out resets

 * for connection which have no listeners and IP directly calls

 * tcp_xmit_listeners_reset() which does any policy check.

 *

 * Protection and Synchronisation mechanism:

 *

 * The tcp data structure does not use any kind of lock for protecting

 * its state but instead uses 'squeues' for mutual exclusion from various

 * read and write side threads. To access a tcp member, the thread should

 * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or

 * squeue_fill). Since the squeues allow a direct function call, caller

 * can pass any tcp function having prototype of edesc_t as argument

 * (different from traditional STREAMs model where packets come in only

 * designated entry points). The list of functions that can be directly

 * called via squeue are listed before the usual function prototype.

 *

 * Referencing:

 *

 * TCP is MT-Hot and we use a reference based scheme to make sure that the

 * tcp structure doesn't disappear when its needed. When the application

 * creates an outgoing connection or accepts an incoming connection, we

 * start out with 2 references on 'conn_ref'. One for TCP and one for IP.

 * The IP reference is just a symbolic reference since ip_tcpclose()

 * looks at tcp structure after tcp_close_output() returns which could

 * have dropped the last TCP reference. So as long as the connection is

 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the

 * conn_t. The classifier puts its own reference when the connection is

 * inserted in listen or connected hash. Anytime a thread needs to enter

 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr

 * on write side or by doing a classify on read side and then puts a

 * reference on the conn before doing squeue_enter/tryenter/fill. For

 * read side, the classifier itself puts the reference under fanout lock

 * to make sure that tcp can't disappear before it gets processed. The

 * squeue will drop this reference automatically so the called function

 * doesn't have to do a DEC_REF.

 *

 * Opening a new connection:

 *

 * The outgoing connection open is pretty simple. ip_tcpopen() does the

 * work in creating the conn/tcp structure and initializing it. The

 * squeue assignment is done based on the CPU the application

 * is running on. So for outbound connections, processing is always done

 * on application CPU which might be different from the incoming CPU

 * being interrupted by the NIC. An optimal way would be to figure out

 * the NIC <-> CPU binding at listen time, and assign the outgoing

 * connection to the squeue attached to the CPU that will be interrupted

 * for incoming packets (we know the NIC based on the bind IP address).

 * This might seem like a problem if more data is going out but the

 * fact is that in most cases the transmit is ACK driven transmit where

 * the outgoing data normally sits on TCP's xmit queue waiting to be

 * transmitted.

 *

 * Accepting a connection:

 *

 * This is a more interesting case because of various races involved in

 * establishing a eager in its own perimeter. Read the meta comment on

 * top of tcp_conn_request(). But briefly, the squeue is picked by

 * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU.

 *

 * Closing a connection:

 *

 * The close is fairly straight forward. tcp_close() calls tcp_close_output()

 * via squeue to do the close and mark the tcp as detached if the connection

 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its

 * reference but tcp_close() drop IP's reference always. So if tcp was

 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP

 * and 1 because it is in classifier's connected hash. This is the condition

 * we use to determine that its OK to clean up the tcp outside of squeue

 * when time wait expires (check the ref under fanout and conn_lock and

 * if it is 2, remove it from fanout hash and kill it).

 *

 * Although close just drops the necessary references and marks the

 * tcp_detached state, tcp_close needs to know the tcp_detached has been

 * set (under squeue) before letting the STREAM go away (because a

 * inbound packet might attempt to go up the STREAM while the close

 * has happened and tcp_detached is not set). So a special lock and

 * flag is used along with a condition variable (tcp_closelock, tcp_closed,

 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked

 * tcp_detached.

 *

 * Special provisions and fast paths:

 *

 * We make special provision for (AF_INET, SOCK_STREAM) sockets which

 * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP

 * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles

 * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY

 * check to send packets directly to tcp_rput_data via squeue. Everyone

 * else comes through tcp_input() on the read side.

 *

 * We also make special provisions for sockfs by marking tcp_issocket

 * whenever we have only sockfs on top of TCP. This allows us to skip

 * putting the tcp in acceptor hash since a sockfs listener can never

 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM

 * since eager has already been allocated and the accept now happens

 * on acceptor STREAM. There is a big blob of comment on top of

 * tcp_conn_request explaining the new accept. When socket is POP'd,

 * sockfs sends us an ioctl to mark the fact and we go back to old

 * behaviour. Once tcp_issocket is unset, its never set for the

 * life of that connection.

 *

 * IPsec notes :

 *

 * Since a packet is always executed on the correct TCP perimeter

 * all IPsec processing is defered to IP including checking new

 * connections and setting IPSEC policies for new connection. The

 * only exception is tcp_xmit_listeners_reset() which is called

 * directly from IP and needs to policy check to see if TH_RST

 * can be sent out.

 */

extern major_t TCP6_MAJ;

/*

 * Values for squeue switch:

 * 1: squeue_enter_nodrain

 * 2: squeue_enter

 * 3: squeue_fill

 */

int tcp_squeue_close = 2;

int tcp_squeue_wput = 2;

squeue_func_t tcp_squeue_close_proc;

squeue_func_t tcp_squeue_wput_proc;

/*

 * This controls how tiny a write must be before we try to copy it

 * into the the mblk on the tail of the transmit queue.  Not much

 * speedup is observed for values larger than sixteen.  Zero will

 * disable the optimisation.

 */

int tcp_tx_pull_len = 16;

/*

 * TCP Statistics.

 *

 * How TCP statistics work.

 *

 * There are two types of statistics invoked by two macros.

 *

 * TCP_STAT(name) does non-atomic increment of a named stat counter. It is

 * supposed to be used in non MT-hot paths of the code.

 *

 * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is

 * supposed to be used for DEBUG purposes and may be used on a hot path.

 *

 * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat

 * (use "kstat tcp" to get them).

 *

 * There is also additional debugging facility that marks tcp_clean_death()

 * instances and saves them in tcp_t structure. It is triggered by

 * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for

 * tcp_clean_death() calls that counts the number of times each tag was hit. It

 * is triggered by TCP_CLD_COUNTERS define.

 *

 * How to add new counters.

 *

 * 1) Add a field in the tcp_stat structure describing your counter.

 * 2) Add a line in tcp_statistics with the name of the counter.

 *

 *    IMPORTANT!! - make sure that both are in sync !!

 * 3) Use either TCP_STAT or TCP_DBGSTAT with the name.

 *

 * Please avoid using private counters which are not kstat-exported.

 *

 * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances

 * in tcp_t structure.

 *

 * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags.

 */

#ifndef TCP_DEBUG_COUNTER

#ifdef DEBUG

#define	TCP_DEBUG_COUNTER 1

#else

#define	TCP_DEBUG_COUNTER 0

#endif

#endif

#define	TCP_TAG_CLEAN_DEATH 1

#define	TCP_MAX_CLEAN_DEATH_TAG 32

#ifdef lint

static int _lint_dummy_;

#endif

#if TCP_CLD_COUNTERS

static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG];

#define	TCP_CLD_STAT(x) tcp_clean_death_stat[x]++

#elif defined(lint)

#define	TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0);

#else

#define	TCP_CLD_STAT(x)

#endif

#if TCP_DEBUG_COUNTER

#define	TCP_DBGSTAT(x) atomic_add_64(&(tcp_statistics.x.value.ui64), 1)

#elif defined(lint)

#define	TCP_DBGSTAT(x) ASSERT(_lint_dummy_ == 0);

#else

#define	TCP_DBGSTAT(x)

#endif

	{ "tcp_time_wait",		KSTAT_DATA_UINT64 },

	{ "tcp_time_wait_syn",		KSTAT_DATA_UINT64 },

	{ "tcp_time_wait_success",	KSTAT_DATA_UINT64 },

	{ "tcp_time_wait_fail",		KSTAT_DATA_UINT64 },

	{ "tcp_reinput_syn",		KSTAT_DATA_UINT64 },

	{ "tcp_ip_output",		KSTAT_DATA_UINT64 },

	{ "tcp_detach_non_time_wait",	KSTAT_DATA_UINT64 },

	{ "tcp_detach_time_wait",	KSTAT_DATA_UINT64 },

	{ "tcp_time_wait_reap",		KSTAT_DATA_UINT64 },

	{ "tcp_clean_death_nondetached",	KSTAT_DATA_UINT64 },

	{ "tcp_reinit_calls",		KSTAT_DATA_UINT64 },

	{ "tcp_eager_err1",		KSTAT_DATA_UINT64 },

	{ "tcp_eager_err2",		KSTAT_DATA_UINT64 },

	{ "tcp_eager_blowoff_calls",	KSTAT_DATA_UINT64 },

	{ "tcp_eager_blowoff_q",	KSTAT_DATA_UINT64 },

	{ "tcp_eager_blowoff_q0",	KSTAT_DATA_UINT64 },

	{ "tcp_not_hard_bound",		KSTAT_DATA_UINT64 },

	{ "tcp_no_listener",		KSTAT_DATA_UINT64 },

	{ "tcp_found_eager",		KSTAT_DATA_UINT64 },

	{ "tcp_wrong_queue",		KSTAT_DATA_UINT64 },

	{ "tcp_found_eager_binding1",	KSTAT_DATA_UINT64 },

	{ "tcp_found_eager_bound1",	KSTAT_DATA_UINT64 },

	{ "tcp_eager_has_listener1",	KSTAT_DATA_UINT64 },

	{ "tcp_open_alloc",		KSTAT_DATA_UINT64 },

	{ "tcp_open_detached_alloc",	KSTAT_DATA_UINT64 },

	{ "tcp_rput_time_wait",		KSTAT_DATA_UINT64 },

	{ "tcp_listendrop",		KSTAT_DATA_UINT64 },

	{ "tcp_listendropq0",		KSTAT_DATA_UINT64 },

	{ "tcp_wrong_rq",		KSTAT_DATA_UINT64 },

	{ "tcp_rsrv_calls",		KSTAT_DATA_UINT64 },

	{ "tcp_eagerfree2",		KSTAT_DATA_UINT64 },

	{ "tcp_eagerfree3",		KSTAT_DATA_UINT64 },

	{ "tcp_eagerfree4",		KSTAT_DATA_UINT64 },

	{ "tcp_eagerfree5",		KSTAT_DATA_UINT64 },

	{ "tcp_timewait_syn_fail",	KSTAT_DATA_UINT64 },

	{ "tcp_listen_badflags",	KSTAT_DATA_UINT64 },

	{ "tcp_timeout_calls",		KSTAT_DATA_UINT64 },

	{ "tcp_timeout_cached_alloc",	KSTAT_DATA_UINT64 },

	{ "tcp_timeout_cancel_reqs",	KSTAT_DATA_UINT64 },

	{ "tcp_timeout_canceled",	KSTAT_DATA_UINT64 },

	{ "tcp_timermp_alloced",	KSTAT_DATA_UINT64 },

	{ "tcp_timermp_freed",		KSTAT_DATA_UINT64 },

	{ "tcp_timermp_allocfail",	KSTAT_DATA_UINT64 },

	{ "tcp_timermp_allocdblfail",	KSTAT_DATA_UINT64 },

	{ "tcp_push_timer_cnt",		KSTAT_DATA_UINT64 },

	{ "tcp_ack_timer_cnt",		KSTAT_DATA_UINT64 },

	{ "tcp_ire_null1",		KSTAT_DATA_UINT64 },

	{ "tcp_ire_null",		KSTAT_DATA_UINT64 },

	{ "tcp_ip_send",		KSTAT_DATA_UINT64 },

	{ "tcp_ip_ire_send",		KSTAT_DATA_UINT64 },

	{ "tcp_wsrv_called",		KSTAT_DATA_UINT64 },

	{ "tcp_flwctl_on",		KSTAT_DATA_UINT64 },

	{ "tcp_timer_fire_early",	KSTAT_DATA_UINT64 },

	{ "tcp_timer_fire_miss",	KSTAT_DATA_UINT64 },

	{ "tcp_freelist_cleanup",	KSTAT_DATA_UINT64 },

	{ "tcp_rput_v6_error",		KSTAT_DATA_UINT64 },

	{ "tcp_out_sw_cksum",		KSTAT_DATA_UINT64 },

	{ "tcp_zcopy_on",		KSTAT_DATA_UINT64 },

	{ "tcp_zcopy_off",		KSTAT_DATA_UINT64 },

	{ "tcp_zcopy_backoff",		KSTAT_DATA_UINT64 },

	{ "tcp_zcopy_disable",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_pkt_out",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_pkt_out_v4",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_pkt_out_v6",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_discarded",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_conn_halted1",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_conn_halted2",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_conn_halted3",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_conn_resumed1",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_conn_resumed2",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_legacy_small",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_legacy_all",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_legacy_ret",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_allocfail",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_addpdescfail",	KSTAT_DATA_UINT64 },

	{ "tcp_mdt_allocd",		KSTAT_DATA_UINT64 },

	{ "tcp_mdt_linked",		KSTAT_DATA_UINT64 },

	{ "tcp_fusion_flowctl",		KSTAT_DATA_UINT64 },

	{ "tcp_fusion_backenabled",	KSTAT_DATA_UINT64 },

	{ "tcp_fusion_urg",		KSTAT_DATA_UINT64 },

	{ "tcp_fusion_putnext",		KSTAT_DATA_UINT64 },

	{ "tcp_fusion_unfusable",	KSTAT_DATA_UINT64 },

	{ "tcp_fusion_aborted",		KSTAT_DATA_UINT64 },

	{ "tcp_fusion_unqualified",	KSTAT_DATA_UINT64 },

	{ "tcp_in_ack_unsent_drop",	KSTAT_DATA_UINT64 },

};

static kstat_t *tcp_kstat;

/*

 * Call either ip_output or ip_output_v6. This replaces putnext() calls on the

 * tcp write side.

 */

#define	CALL_IP_WPUT(connp, q, mp) {					\

	ASSERT(((q)->q_flag & QREADR) == 0);				\

	TCP_DBGSTAT(tcp_ip_output);					\

	connp->conn_send(connp, (mp), (q), IP_WPUT);			\

}

/* Macros for timestamp comparisons */

#define	TSTMP_GEQ(a, b)	((int32_t)((a)-(b)) >= 0)

#define	TSTMP_LT(a, b)	((int32_t)((a)-(b)) < 0)

/*

 * Parameters for TCP Initial Send Sequence number (ISS) generation.  When

 * tcp_strong_iss is set to 1, which is the default, the ISS is calculated

 * by adding three components: a time component which grows by 1 every 4096

 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27);

 * a per-connection component which grows by 125000 for every new connection;

 * and an "extra" component that grows by a random amount centered

 * approximately on 64000.  This causes the the ISS generator to cycle every

 * 4.89 hours if no TCP connections are made, and faster if connections are

 * made.

 *

 * When tcp_strong_iss is set to 0, ISS is calculated by adding two

 * components: a time component which grows by 250000 every second; and

 * a per-connection component which grows by 125000 for every new connections.

 *

 * A third method, when tcp_strong_iss is set to 2, for generating ISS is

 * prescribed by Steve Bellovin.  This involves adding time, the 125000 per

 * connection, and a one-way hash (MD5) of the connection ID <sport, dport,

 * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered

 * password.

 */

#define	ISS_INCR	250000

#define	ISS_NSEC_SHT	12

static uint32_t tcp_iss_incr_extra;	/* Incremented for each connection */

static kmutex_t tcp_iss_key_lock;

static MD5_CTX tcp_iss_key;

static sin_t	sin_null;	/* Zero address for quick clears */

static sin6_t	sin6_null;	/* Zero address for quick clears */

/* Packet dropper for TCP IPsec policy drops. */

static ipdropper_t tcp_dropper;

/*

 * This implementation follows the 4.3BSD interpretation of the urgent

 * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause

 * incompatible changes in protocols like telnet and rlogin.

 */

#define	TCP_OLD_URP_INTERPRETATION	1

#define	TCP_IS_DETACHED_NONEAGER(tcp)	\

	(TCP_IS_DETACHED(tcp) && \

	    (!(tcp)->tcp_hard_binding))

/*

 * TCP reassembly macros.  We hide starting and ending sequence numbers in

 * b_next and b_prev of messages on the reassembly queue.  The messages are

 * chained using b_cont.  These macros are used in tcp_reass() so we don't

 * have to see the ugly casts and assignments.

 */

#define	TCP_REASS_SEQ(mp)		((uint32_t)(uintptr_t)((mp)->b_next))

#define	TCP_REASS_SET_SEQ(mp, u)	((mp)->b_next = \

					(mblk_t *)(uintptr_t)(u))

#define	TCP_REASS_END(mp)		((uint32_t)(uintptr_t)((mp)->b_prev))

#define	TCP_REASS_SET_END(mp, u)	((mp)->b_prev = \

					(mblk_t *)(uintptr_t)(u))

/*

 * Implementation of TCP Timers.

 * =============================

 *

 * INTERFACE:

 *

 * There are two basic functions dealing with tcp timers:

 *

 *	timeout_id_t	tcp_timeout(connp, func, time)

 * 	clock_t		tcp_timeout_cancel(connp, timeout_id)

 *	TCP_TIMER_RESTART(tcp, intvl)

 *

 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func'

 * after 'time' ticks passed. The function called by timeout() must adhere to

 * the same restrictions as a driver soft interrupt handler - it must not sleep

 * or call other functions that might sleep. The value returned is the opaque

 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to

 * cancel the request. The call to tcp_timeout() may fail in which case it

 * returns zero. This is different from the timeout(9F) function which never

 * fails.

 *

 * The call-back function 'func' always receives 'connp' as its single

 * argument. It is always executed in the squeue corresponding to the tcp

 * structure. The tcp structure is guaranteed to be present at the time the

 * call-back is called.

 *

 * NOTE: The call-back function 'func' is never called if tcp is in

 * 	the TCPS_CLOSED state.

 *

 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout()

 * request. locks acquired by the call-back routine should not be held across

 * the call to tcp_timeout_cancel() or a deadlock may result.

 *

 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request.

 * Otherwise, it returns an integer value greater than or equal to 0. In

 * particular, if the call-back function is already placed on the squeue, it can

 * not be canceled.

 *

 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called

 * 	within squeue context corresponding to the tcp instance. Since the

 *	call-back is also called via the same squeue, there are no race

 *	conditions described in untimeout(9F) manual page since all calls are

 *	strictly serialized.

 *

 *      TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout

 *	stored in tcp_timer_tid and starts a new one using

 *	MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back

 *	and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid