xref: /openbsd-src/sys/netinet/tcp_output.c (revision f74ca6b99eaca0e6b02468b10c0382ab8e7d49ce)
1 /*	$OpenBSD: tcp_output.c,v 1.71 2004/06/20 18:16:50 itojun Exp $	*/
2 /*	$NetBSD: tcp_output.c,v 1.16 1997/06/03 16:17:09 kml Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  * 	This product includes software developed by the University of
46  * 	California, Berkeley and its contributors.
47  * 	This product includes software developed at the Information
48  * 	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/kernel.h>
78 
79 #include <net/route.h>
80 #include <net/if.h>
81 
82 #include <netinet/in.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/ip.h>
85 #include <netinet/in_pcb.h>
86 #include <netinet/ip_var.h>
87 #include <netinet/tcp.h>
88 #define	TCPOUTFLAGS
89 #include <netinet/tcp_fsm.h>
90 #include <netinet/tcp_seq.h>
91 #include <netinet/tcp_timer.h>
92 #include <netinet/tcp_var.h>
93 #include <netinet/tcpip.h>
94 #include <netinet/tcp_debug.h>
95 
96 #ifdef INET6
97 #include <netinet6/tcpipv6.h>
98 #include <netinet6/in6_var.h>
99 #endif /* INET6 */
100 
101 #ifdef notyet
102 extern struct mbuf *m_copypack();
103 #endif
104 
105 #ifdef TCP_SACK
106 extern int tcprexmtthresh;
107 #endif
108 
109 #ifdef TCP_SACK
110 #ifdef TCP_SACK_DEBUG
111 void tcp_print_holes(struct tcpcb *tp);
112 
113 void
114 tcp_print_holes(struct tcpcb *tp)
115 {
116 	struct sackhole *p = tp->snd_holes;
117 	if (p == 0)
118 		return;
119 	printf("Hole report: start--end dups rxmit\n");
120 	while (p) {
121 		printf("%x--%x d %d r %x\n", p->start, p->end, p->dups,
122 		    p->rxmit);
123 		p = p->next;
124 	}
125 	printf("\n");
126 }
127 #endif /* TCP_SACK_DEBUG */
128 
129 /*
130  * Returns pointer to a sackhole if there are any pending retransmissions;
131  * NULL otherwise.
132  */
133 struct sackhole *
134 tcp_sack_output(struct tcpcb *tp)
135 {
136 	struct sackhole *p;
137 
138 	if (!tp->sack_enable)
139 		return (NULL);
140 	p = tp->snd_holes;
141 	while (p) {
142 #ifndef TCP_FACK
143 		if (p->dups >= tcprexmtthresh && SEQ_LT(p->rxmit, p->end)) {
144 #else
145 		/* In FACK, if p->dups is less than tcprexmtthresh, but
146 		 * snd_fack advances more than tcprextmtthresh * tp->t_maxseg,
147 		 * tcp_input() will try fast retransmit. This forces output.
148 		 */
149 		if ((p->dups >= tcprexmtthresh ||
150 		     tp->t_dupacks == tcprexmtthresh) &&
151 		    SEQ_LT(p->rxmit, p->end)) {
152 #endif /* TCP_FACK */
153 			if (SEQ_LT(p->rxmit, tp->snd_una)) {/* old SACK hole */
154 				p = p->next;
155 				continue;
156 			}
157 #ifdef TCP_SACK_DEBUG
158 			if (p)
159 				tcp_print_holes(tp);
160 #endif
161 			return (p);
162 		}
163         	p = p->next;
164 	}
165 	return (NULL);
166 }
167 
168 /*
169  * After a timeout, the SACK list may be rebuilt.  This SACK information
170  * should be used to avoid retransmitting SACKed data.  This function
171  * traverses the SACK list to see if snd_nxt should be moved forward.
172  */
173 
174 void
175 tcp_sack_adjust(struct tcpcb *tp)
176 {
177 	struct sackhole *cur = tp->snd_holes;
178 	if (cur == NULL)
179 		return; /* No holes */
180 	if (SEQ_GEQ(tp->snd_nxt, tp->rcv_lastsack))
181 		return; /* We're already beyond any SACKed blocks */
182 	/*
183 	 * Two cases for which we want to advance snd_nxt:
184 	 * i) snd_nxt lies between end of one hole and beginning of another
185 	 * ii) snd_nxt lies between end of last hole and rcv_lastsack
186 	 */
187 	while (cur->next) {
188 		if (SEQ_LT(tp->snd_nxt, cur->end))
189 			return;
190 		if (SEQ_GEQ(tp->snd_nxt, cur->next->start))
191 			cur = cur->next;
192 		else {
193 			tp->snd_nxt = cur->next->start;
194 			return;
195 		}
196 	}
197 	if (SEQ_LT(tp->snd_nxt, cur->end))
198 		return;
199 	tp->snd_nxt = tp->rcv_lastsack;
200 	return;
201 }
202 #endif /* TCP_SACK */
203 
204 /*
205  * Tcp output routine: figure out what should be sent and send it.
206  */
207 int
208 tcp_output(tp)
209 	struct tcpcb *tp;
210 {
211 	struct socket *so = tp->t_inpcb->inp_socket;
212 	long len, win, txmaxseg;
213 	int off, flags, error;
214 	struct mbuf *m;
215 	struct tcphdr *th;
216 	u_char opt[MAX_TCPOPTLEN];
217 	unsigned int optlen, hdrlen;
218 	int idle, sendalot = 0;
219 #ifdef TCP_SACK
220 	int i, sack_rxmit = 0;
221 	struct sackhole *p;
222 #endif
223 #if defined(TCP_SACK)
224 	int maxburst = TCP_MAXBURST;
225 #endif
226 #ifdef TCP_SIGNATURE
227 	unsigned int sigoff;
228 #endif /* TCP_SIGNATURE */
229 #ifdef TCP_ECN
230 	int needect;
231 #endif
232 
233 #if defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC)
234 	if (tp->sack_enable && (tp->t_flags & TF_SIGNATURE))
235 		return (EINVAL);
236 #endif /* defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC) */
237 
238 	/*
239 	 * Determine length of data that should be transmitted,
240 	 * and flags that will be used.
241 	 * If there is some data or critical controls (SYN, RST)
242 	 * to send, then transmit; otherwise, investigate further.
243 	 */
244 	idle = (tp->snd_max == tp->snd_una);
245 	if (idle && (tcp_now - tp->t_rcvtime) >= tp->t_rxtcur)
246 		/*
247 		 * We have been idle for "a while" and no acks are
248 		 * expected to clock out any data we send --
249 		 * slow start to get ack "clock" running again.
250 		 */
251 		tp->snd_cwnd = tp->t_maxseg;
252 again:
253 #ifdef TCP_SACK
254 	/*
255 	 * If we've recently taken a timeout, snd_max will be greater than
256 	 * snd_nxt.  There may be SACK information that allows us to avoid
257 	 * resending already delivered data.  Adjust snd_nxt accordingly.
258 	 */
259 	if (tp->sack_enable && SEQ_LT(tp->snd_nxt, tp->snd_max))
260 		tcp_sack_adjust(tp);
261 #endif
262 	off = tp->snd_nxt - tp->snd_una;
263 #if defined(TCP_SACK) && defined(TCP_FACK)
264 	/* Normally, sendable data is limited by off < tp->snd_cwnd.
265 	 * But in FACK, sendable data is limited by snd_awnd < snd_cwnd,
266 	 * regardless of offset.
267 	 */
268 	if (tp->sack_enable && (tp->t_dupacks > tcprexmtthresh))
269 		win = tp->snd_wnd;
270 	else
271 #endif
272 	win = ulmin(tp->snd_wnd, tp->snd_cwnd);
273 
274 	flags = tcp_outflags[tp->t_state];
275 
276 #ifdef TCP_SACK
277 	/*
278 	 * Send any SACK-generated retransmissions.  If we're explicitly trying
279 	 * to send out new data (when sendalot is 1), bypass this function.
280 	 * If we retransmit in fast recovery mode, decrement snd_cwnd, since
281 	 * we're replacing a (future) new transmission with a retransmission
282 	 * now, and we previously incremented snd_cwnd in tcp_input().
283 	 */
284 	if (tp->sack_enable && !sendalot) {
285 		if (tp->t_dupacks >= tcprexmtthresh &&
286 		    (p = tcp_sack_output(tp))) {
287 			off = p->rxmit - tp->snd_una;
288 			sack_rxmit = 1;
289 #if 0
290 			/* Coalesce holes into a single retransmission */
291 #endif
292 			len = min(tp->t_maxseg, p->end - p->rxmit);
293 #ifndef TCP_FACK
294 			/* in FACK, hold snd_cwnd constant during recovery */
295 			if (SEQ_LT(tp->snd_una, tp->snd_last))
296 				tp->snd_cwnd -= tp->t_maxseg;
297 #endif
298     		}
299 	}
300 #endif /* TCP_SACK */
301 
302 	sendalot = 0;
303 	/*
304 	 * If in persist timeout with window of 0, send 1 byte.
305 	 * Otherwise, if window is small but nonzero
306 	 * and timer expired, we will send what we can
307 	 * and go to transmit state.
308 	 */
309 	if (tp->t_force) {
310 		if (win == 0) {
311 			/*
312 			 * If we still have some data to send, then
313 			 * clear the FIN bit.  Usually this would
314 			 * happen below when it realizes that we
315 			 * aren't sending all the data.  However,
316 			 * if we have exactly 1 byte of unset data,
317 			 * then it won't clear the FIN bit below,
318 			 * and if we are in persist state, we wind
319 			 * up sending the packet without recording
320 			 * that we sent the FIN bit.
321 			 *
322 			 * We can't just blindly clear the FIN bit,
323 			 * because if we don't have any more data
324 			 * to send then the probe will be the FIN
325 			 * itself.
326 			 */
327 			if (off < so->so_snd.sb_cc)
328 				flags &= ~TH_FIN;
329 			win = 1;
330 		} else {
331 			TCP_TIMER_DISARM(tp, TCPT_PERSIST);
332 			tp->t_rxtshift = 0;
333 		}
334 	}
335 
336 #ifdef TCP_SACK
337 	if (!sack_rxmit) {
338 #endif
339 	len = ulmin(so->so_snd.sb_cc, win) - off;
340 
341 #if defined(TCP_SACK) && defined(TCP_FACK)
342 	/*
343 	 * If we're in fast recovery (SEQ_GT(tp->snd_last, tp->snd_una)), and
344 	 * amount of outstanding data (snd_awnd) is >= snd_cwnd, then
345 	 * do not send data (like zero window conditions)
346 	 */
347 	if (tp->sack_enable && len && SEQ_GT(tp->snd_last, tp->snd_una) &&
348 	    (tp->snd_awnd >= tp->snd_cwnd))
349 		len = 0;
350 #endif /* TCP_FACK */
351 #ifdef TCP_SACK
352 	}
353 #endif
354 
355 	if (len < 0) {
356 		/*
357 		 * If FIN has been sent but not acked,
358 		 * but we haven't been called to retransmit,
359 		 * len will be -1.  Otherwise, window shrank
360 		 * after we sent into it.  If window shrank to 0,
361 		 * cancel pending retransmit, pull snd_nxt back
362 		 * to (closed) window, and set the persist timer
363 		 * if it isn't already going.  If the window didn't
364 		 * close completely, just wait for an ACK.
365 		 */
366 		len = 0;
367 		if (win == 0) {
368 			TCP_TIMER_DISARM(tp, TCPT_REXMT);
369 			tp->t_rxtshift = 0;
370 			tp->snd_nxt = tp->snd_una;
371 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
372 				tcp_setpersist(tp);
373 		}
374 	}
375 
376         /*
377          * Never send more than half a buffer full.  This insures that we can
378          * always keep 2 packets on the wire, no matter what SO_SNDBUF is, and
379          * therefore acks will never be delayed unless we run out of data to
380          * transmit.
381          */
382 	txmaxseg = ulmin(so->so_snd.sb_hiwat / 2, tp->t_maxseg);
383 
384 	if (len > txmaxseg) {
385 		len = txmaxseg;
386 		sendalot = 1;
387 	}
388 	if (off + len < so->so_snd.sb_cc)
389 		flags &= ~TH_FIN;
390 
391 	win = sbspace(&so->so_rcv);
392 
393 	/*
394 	 * Sender silly window avoidance.  If connection is idle
395 	 * and can send all data, a maximum segment,
396 	 * at least a maximum default-size segment do it,
397 	 * or are forced, do it; otherwise don't bother.
398 	 * If peer's buffer is tiny, then send
399 	 * when window is at least half open.
400 	 * If retransmitting (possibly after persist timer forced us
401 	 * to send into a small window), then must resend.
402 	 */
403 	if (len) {
404 		if (len == txmaxseg)
405 			goto send;
406 		if ((idle || tp->t_flags & TF_NODELAY) &&
407 		    len + off >= so->so_snd.sb_cc)
408 			goto send;
409 		if (tp->t_force)
410 			goto send;
411 		if (len >= tp->max_sndwnd / 2 && tp->max_sndwnd > 0)
412 			goto send;
413 		if (SEQ_LT(tp->snd_nxt, tp->snd_max))
414 			goto send;
415 #ifdef TCP_SACK
416 		if (sack_rxmit)
417 			goto send;
418 #endif
419 	}
420 
421 	/*
422 	 * Compare available window to amount of window
423 	 * known to peer (as advertised window less
424 	 * next expected input).  If the difference is at least two
425 	 * max size segments, or at least 50% of the maximum possible
426 	 * window, then want to send a window update to peer.
427 	 */
428 	if (win > 0) {
429 		/*
430 		 * "adv" is the amount we can increase the window,
431 		 * taking into account that we are limited by
432 		 * TCP_MAXWIN << tp->rcv_scale.
433 		 */
434 		long adv = lmin(win, (long)TCP_MAXWIN << tp->rcv_scale) -
435 			(tp->rcv_adv - tp->rcv_nxt);
436 
437 		if (adv >= (long) (2 * tp->t_maxseg))
438 			goto send;
439 		if (2 * adv >= (long) so->so_rcv.sb_hiwat)
440 			goto send;
441 	}
442 
443 	/*
444 	 * Send if we owe peer an ACK.
445 	 */
446 	if (tp->t_flags & TF_ACKNOW)
447 		goto send;
448 	if (flags & (TH_SYN|TH_RST))
449 		goto send;
450 	if (SEQ_GT(tp->snd_up, tp->snd_una))
451 		goto send;
452 	/*
453 	 * If our state indicates that FIN should be sent
454 	 * and we have not yet done so, or we're retransmitting the FIN,
455 	 * then we need to send.
456 	 */
457 	if (flags & TH_FIN &&
458 	    ((tp->t_flags & TF_SENTFIN) == 0 || tp->snd_nxt == tp->snd_una))
459 		goto send;
460 #ifdef TCP_SACK
461 	/*
462 	 * In SACK, it is possible for tcp_output to fail to send a segment
463 	 * after the retransmission timer has been turned off.  Make sure
464 	 * that the retransmission timer is set.
465 	 */
466 	if (SEQ_GT(tp->snd_max, tp->snd_una) &&
467 	    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
468 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
469 		TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
470 		return (0);
471 	}
472 #endif /* TCP_SACK */
473 
474 	/*
475 	 * TCP window updates are not reliable, rather a polling protocol
476 	 * using ``persist'' packets is used to insure receipt of window
477 	 * updates.  The three ``states'' for the output side are:
478 	 *	idle			not doing retransmits or persists
479 	 *	persisting		to move a small or zero window
480 	 *	(re)transmitting	and thereby not persisting
481 	 *
482 	 * tp->t_timer[TCPT_PERSIST]
483 	 *	is set when we are in persist state.
484 	 * tp->t_force
485 	 *	is set when we are called to send a persist packet.
486 	 * tp->t_timer[TCPT_REXMT]
487 	 *	is set when we are retransmitting
488 	 * The output side is idle when both timers are zero.
489 	 *
490 	 * If send window is too small, there is data to transmit, and no
491 	 * retransmit or persist is pending, then go to persist state.
492 	 * If nothing happens soon, send when timer expires:
493 	 * if window is nonzero, transmit what we can,
494 	 * otherwise force out a byte.
495 	 */
496 	if (so->so_snd.sb_cc && TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
497 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
498 		tp->t_rxtshift = 0;
499 		tcp_setpersist(tp);
500 	}
501 
502 	/*
503 	 * No reason to send a segment, just return.
504 	 */
505 	return (0);
506 
507 send:
508 	/*
509 	 * Before ESTABLISHED, force sending of initial options
510 	 * unless TCP set not to do any options.
511 	 * NOTE: we assume that the IP/TCP header plus TCP options
512 	 * always fit in a single mbuf, leaving room for a maximum
513 	 * link header, i.e.
514 	 *	max_linkhdr + sizeof(network header) + sizeof(struct tcphdr +
515 	 * 		optlen <= MHLEN
516 	 */
517 	optlen = 0;
518 
519 	switch (tp->pf) {
520 	case 0:	/*default to PF_INET*/
521 #ifdef INET
522 	case PF_INET:
523 		hdrlen = sizeof(struct ip) + sizeof(struct tcphdr);
524 		break;
525 #endif /* INET */
526 #ifdef INET6
527 	case PF_INET6:
528 		hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
529 		break;
530 #endif /* INET6 */
531 	default:
532 		return (EPFNOSUPPORT);
533 	}
534 
535 	if (flags & TH_SYN) {
536 		tp->snd_nxt = tp->iss;
537 		if ((tp->t_flags & TF_NOOPT) == 0) {
538 			u_int16_t mss;
539 
540 			opt[0] = TCPOPT_MAXSEG;
541 			opt[1] = 4;
542 			mss = htons((u_int16_t) tcp_mss(tp, 0));
543 			bcopy((caddr_t)&mss, (caddr_t)(opt + 2), sizeof(mss));
544 			optlen = 4;
545 
546 			if (flags & TH_ACK)
547 				tcp_mss_update(tp);
548 #ifdef TCP_SACK
549 			/*
550 			 * If this is the first SYN of connection (not a SYN
551 			 * ACK), include SACK_PERMIT_HDR option.  If this is a
552 			 * SYN ACK, include SACK_PERMIT_HDR option if peer has
553 			 * already done so.
554 			 */
555 			if (tp->sack_enable && ((flags & TH_ACK) == 0 ||
556 			    (tp->t_flags & TF_SACK_PERMIT))) {
557 				*((u_int32_t *) (opt + optlen)) =
558 				    htonl(TCPOPT_SACK_PERMIT_HDR);
559 				optlen += 4;
560 			}
561 #endif
562 
563 			if ((tp->t_flags & TF_REQ_SCALE) &&
564 			    ((flags & TH_ACK) == 0 ||
565 			    (tp->t_flags & TF_RCVD_SCALE))) {
566 				*((u_int32_t *) (opt + optlen)) = htonl(
567 					TCPOPT_NOP << 24 |
568 					TCPOPT_WINDOW << 16 |
569 					TCPOLEN_WINDOW << 8 |
570 					tp->request_r_scale);
571 				optlen += 4;
572 			}
573 		}
574 	}
575 
576 	/*
577 	 * Send a timestamp and echo-reply if this is a SYN and our side
578 	 * wants to use timestamps (TF_REQ_TSTMP is set) or both our side
579 	 * and our peer have sent timestamps in our SYN's.
580 	 */
581 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
582 	     (flags & TH_RST) == 0 &&
583 	    ((flags & (TH_SYN|TH_ACK)) == TH_SYN ||
584 	     (tp->t_flags & TF_RCVD_TSTMP))) {
585 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
586 
587 		/* Form timestamp option as shown in appendix A of RFC 1323. */
588 		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
589 		*lp++ = htonl(tcp_now);
590 		*lp   = htonl(tp->ts_recent);
591 		optlen += TCPOLEN_TSTAMP_APPA;
592 	}
593 
594 #ifdef TCP_SIGNATURE
595 	if (tp->t_flags & TF_SIGNATURE) {
596 		u_int8_t *bp = (u_int8_t *)(opt + optlen);
597 
598 		/* Send signature option */
599 		*(bp++) = TCPOPT_SIGNATURE;
600 		*(bp++) = TCPOLEN_SIGNATURE;
601 		sigoff = optlen + 2;
602 
603 		{
604 			unsigned int i;
605 
606 			for (i = 0; i < 16; i++)
607 				*(bp++) = 0;
608 		}
609 
610 
611 		/* Pad options list to the next 32 bit boundary and
612 		 * terminate it.
613 		 */
614 		*bp++ = TCPOPT_NOP;
615 		*bp++ = TCPOPT_EOL;
616 
617 		optlen += TCPOLEN_SIGLEN;
618 	}
619 #endif /* TCP_SIGNATURE */
620 
621 #ifdef TCP_SACK
622 	/*
623 	 * Send SACKs if necessary.  This should be the last option processed.
624 	 * Only as many SACKs are sent as are permitted by the maximum options
625 	 * size.  No more than three SACKs are sent.
626 	 */
627 	if (tp->sack_enable && tp->t_state == TCPS_ESTABLISHED &&
628 	    (tp->t_flags & (TF_SACK_PERMIT|TF_NOOPT)) == TF_SACK_PERMIT &&
629 	    tp->rcv_numsacks) {
630 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
631 		u_int32_t *olp = lp++;
632 		int count = 0;  /* actual number of SACKs inserted */
633 		int maxsack = (MAX_TCPOPTLEN - (optlen + 4))/TCPOLEN_SACK;
634 
635 		maxsack = min(maxsack, TCP_MAX_SACK);
636 		for (i = 0; (i < tp->rcv_numsacks && count < maxsack); i++) {
637 			struct sackblk sack = tp->sackblks[i];
638 			if (sack.start == 0 && sack.end == 0)
639 				continue;
640 			*lp++ = htonl(sack.start);
641 			*lp++ = htonl(sack.end);
642 			count++;
643 		}
644 		*olp = htonl(TCPOPT_SACK_HDR|(TCPOLEN_SACK*count+2));
645 		optlen += TCPOLEN_SACK*count + 4; /* including leading NOPs */
646 	}
647 #endif /* TCP_SACK */
648 
649 #ifdef DIAGNOSTIC
650 	if (optlen > MAX_TCPOPTLEN)
651 		panic("tcp_output: options too long");
652 #endif /* DIAGNOSTIC */
653 
654 	hdrlen += optlen;
655 
656 	/*
657 	 * Adjust data length if insertion of options will
658 	 * bump the packet length beyond the t_maxopd length.
659 	 */
660 	if (len > tp->t_maxopd - optlen) {
661 		len = tp->t_maxopd - optlen;
662 		sendalot = 1;
663 		flags &= ~TH_FIN;
664 	 }
665 
666 #ifdef DIAGNOSTIC
667 	if (max_linkhdr + hdrlen > MCLBYTES)
668 		panic("tcphdr too big");
669 #endif
670 
671 	/*
672 	 * Grab a header mbuf, attaching a copy of data to
673 	 * be transmitted, and initialize the header from
674 	 * the template for sends on this connection.
675 	 */
676 	if (len) {
677 		if (tp->t_force && len == 1)
678 			tcpstat.tcps_sndprobe++;
679 		else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) {
680 			tcpstat.tcps_sndrexmitpack++;
681 			tcpstat.tcps_sndrexmitbyte += len;
682 		} else {
683 			tcpstat.tcps_sndpack++;
684 			tcpstat.tcps_sndbyte += len;
685 		}
686 #ifdef notyet
687 		if ((m = m_copypack(so->so_snd.sb_mb, off,
688 		    (int)len, max_linkhdr + hdrlen)) == 0) {
689 			error = ENOBUFS;
690 			goto out;
691 		}
692 		/*
693 		 * m_copypack left space for our hdr; use it.
694 		 */
695 		m->m_len += hdrlen;
696 		m->m_data -= hdrlen;
697 #else
698 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
699 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
700 			MCLGET(m, M_DONTWAIT);
701 			if ((m->m_flags & M_EXT) == 0) {
702 				m_freem(m);
703 				m = NULL;
704 			}
705 		}
706 		if (m == NULL) {
707 			error = ENOBUFS;
708 			goto out;
709 		}
710 		m->m_data += max_linkhdr;
711 		m->m_len = hdrlen;
712 		if (len <= M_TRAILINGSPACE(m)) {
713 			m_copydata(so->so_snd.sb_mb, off, (int) len,
714 			    mtod(m, caddr_t) + hdrlen);
715 			m->m_len += len;
716 		} else {
717 			m->m_next = m_copy(so->so_snd.sb_mb, off, (int) len);
718 			if (m->m_next == 0) {
719 				(void) m_free(m);
720 				error = ENOBUFS;
721 				goto out;
722 			}
723 		}
724 #endif
725 		/*
726 		 * If we're sending everything we've got, set PUSH.
727 		 * (This will keep happy those implementations which only
728 		 * give data to the user when a buffer fills or
729 		 * a PUSH comes in.)
730 		 */
731 		if (off + len == so->so_snd.sb_cc)
732 			flags |= TH_PUSH;
733 	} else {
734 		if (tp->t_flags & TF_ACKNOW)
735 			tcpstat.tcps_sndacks++;
736 		else if (flags & (TH_SYN|TH_FIN|TH_RST))
737 			tcpstat.tcps_sndctrl++;
738 		else if (SEQ_GT(tp->snd_up, tp->snd_una))
739 			tcpstat.tcps_sndurg++;
740 		else
741 			tcpstat.tcps_sndwinup++;
742 
743 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
744 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
745 			MCLGET(m, M_DONTWAIT);
746 			if ((m->m_flags & M_EXT) == 0) {
747 				m_freem(m);
748 				m = NULL;
749 			}
750 		}
751 		if (m == NULL) {
752 			error = ENOBUFS;
753 			goto out;
754 		}
755 		m->m_data += max_linkhdr;
756 		m->m_len = hdrlen;
757 	}
758 	m->m_pkthdr.rcvif = (struct ifnet *)0;
759 	m->m_pkthdr.len = hdrlen + len;
760 
761 	if (!tp->t_template)
762 		panic("tcp_output");
763 #ifdef DIAGNOSTIC
764 	if (tp->t_template->m_len != hdrlen - optlen)
765 		panic("tcp_output: template len != hdrlen - optlen");
766 #endif /* DIAGNOSTIC */
767 	bcopy(mtod(tp->t_template, caddr_t), mtod(m, caddr_t),
768 		tp->t_template->m_len);
769 	th = (struct tcphdr *)(mtod(m, caddr_t) + tp->t_template->m_len -
770 		sizeof(struct tcphdr));
771 
772 	/*
773 	 * Fill in fields, remembering maximum advertised
774 	 * window for use in delaying messages about window sizes.
775 	 * If resending a FIN, be sure not to use a new sequence number.
776 	 */
777 	if ((flags & TH_FIN) && (tp->t_flags & TF_SENTFIN) &&
778 	    (tp->snd_nxt == tp->snd_max))
779 		tp->snd_nxt--;
780 	/*
781 	 * If we are doing retransmissions, then snd_nxt will
782 	 * not reflect the first unsent octet.  For ACK only
783 	 * packets, we do not want the sequence number of the
784 	 * retransmitted packet, we want the sequence number
785 	 * of the next unsent octet.  So, if there is no data
786 	 * (and no SYN or FIN), use snd_max instead of snd_nxt
787 	 * when filling in ti_seq.  But if we are in persist
788 	 * state, snd_max might reflect one byte beyond the
789 	 * right edge of the window, so use snd_nxt in that
790 	 * case, since we know we aren't doing a retransmission.
791 	 * (retransmit and persist are mutually exclusive...)
792 	 */
793 	if (len || (flags & (TH_SYN|TH_FIN)) || TCP_TIMER_ISARMED(tp, TCPT_PERSIST))
794 		th->th_seq = htonl(tp->snd_nxt);
795 	else
796 		th->th_seq = htonl(tp->snd_max);
797 
798 #ifdef TCP_SACK
799 	if (sack_rxmit) {
800 		/*
801 		 * If sendalot was turned on (due to option stuffing), turn it
802 		 * off. Properly set th_seq field.  Advance the ret'x pointer
803 		 * by len.
804 		 */
805 		if (sendalot)
806 			sendalot = 0;
807 		th->th_seq = htonl(p->rxmit);
808 		p->rxmit += len;
809 #if defined(TCP_SACK) && defined(TCP_FACK)
810 		tp->retran_data += len;
811 #endif /* TCP_FACK */
812 	}
813 #endif /* TCP_SACK */
814 
815 	th->th_ack = htonl(tp->rcv_nxt);
816 	if (optlen) {
817 		bcopy((caddr_t)opt, (caddr_t)(th + 1), optlen);
818 		th->th_off = (sizeof (struct tcphdr) + optlen) >> 2;
819 	}
820 #ifdef TCP_ECN
821 	if (tcp_do_ecn) {
822 		/*
823 		 * if we have received congestion experienced segs,
824 		 * set ECE bit.
825 		 */
826 		if (tp->t_flags & TF_RCVD_CE) {
827 			flags |= TH_ECE;
828 			tcpstat.tcps_ecn_sndece++;
829 		}
830 		if (!(tp->t_flags & TF_DISABLE_ECN)) {
831 			/*
832 			 * if this is a SYN seg, set ECE and CWR.
833 			 * set only ECE for SYN-ACK if peer supports ECN.
834 			 */
835 			if ((flags & (TH_SYN|TH_ACK)) == TH_SYN)
836 				flags |= (TH_ECE|TH_CWR);
837 			else if ((tp->t_flags & TF_ECN_PERMIT) &&
838 				 (flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK))
839 				flags |= TH_ECE;
840 		}
841 		/*
842 		 * if we have reduced the congestion window, notify
843 		 * the peer by setting CWR bit.
844 		 */
845 		if ((tp->t_flags & TF_ECN_PERMIT) &&
846 		    (tp->t_flags & TF_SEND_CWR)) {
847 			flags |= TH_CWR;
848 			tp->t_flags &= ~TF_SEND_CWR;
849 			tcpstat.tcps_ecn_sndcwr++;
850 		}
851 	}
852 #endif
853 	th->th_flags = flags;
854 
855 	/*
856 	 * Calculate receive window.  Don't shrink window,
857 	 * but avoid silly window syndrome.
858 	 */
859 	if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg)
860 		win = 0;
861 	if (win > (long)TCP_MAXWIN << tp->rcv_scale)
862 		win = (long)TCP_MAXWIN << tp->rcv_scale;
863 	if (win < (long)(int32_t)(tp->rcv_adv - tp->rcv_nxt))
864 		win = (long)(int32_t)(tp->rcv_adv - tp->rcv_nxt);
865 	if (flags & TH_RST)
866 		win = 0;
867 	th->th_win = htons((u_int16_t) (win>>tp->rcv_scale));
868 	if (SEQ_GT(tp->snd_up, tp->snd_nxt)) {
869 		u_int32_t urp = tp->snd_up - tp->snd_nxt;
870 		if (urp > IP_MAXPACKET)
871 			urp = IP_MAXPACKET;
872 		th->th_urp = htons((u_int16_t)urp);
873 		th->th_flags |= TH_URG;
874 	} else
875 		/*
876 		 * If no urgent pointer to send, then we pull
877 		 * the urgent pointer to the left edge of the send window
878 		 * so that it doesn't drift into the send window on sequence
879 		 * number wraparound.
880 		 */
881 		tp->snd_up = tp->snd_una;		/* drag it along */
882 
883 #ifdef TCP_SIGNATURE
884 	if (tp->t_flags & TF_SIGNATURE) {
885 		int iphlen;
886 		union sockaddr_union src, dst;
887 		struct tdb *tdb;
888 
889 		bzero(&src, sizeof(union sockaddr_union));
890 		bzero(&dst, sizeof(union sockaddr_union));
891 
892 		switch (tp->pf) {
893 		case 0:	/*default to PF_INET*/
894 #ifdef INET
895 		case AF_INET:
896 			iphlen = sizeof(struct ip);
897 			src.sa.sa_len = sizeof(struct sockaddr_in);
898 			src.sa.sa_family = AF_INET;
899 			src.sin.sin_addr = mtod(m, struct ip *)->ip_src;
900 			dst.sa.sa_len = sizeof(struct sockaddr_in);
901 			dst.sa.sa_family = AF_INET;
902 			dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst;
903 			break;
904 #endif /* INET */
905 #ifdef INET6
906 		case AF_INET6:
907 			iphlen = sizeof(struct ip6_hdr);
908 			src.sa.sa_len = sizeof(struct sockaddr_in6);
909 			src.sa.sa_family = AF_INET6;
910 			src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src;
911 			dst.sa.sa_len = sizeof(struct sockaddr_in6);
912 			dst.sa.sa_family = AF_INET6;
913 			dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst;
914 			break;
915 #endif /* INET6 */
916 		}
917 
918 		/* XXX gettdbbysrcdst() should really be called at spltdb(). */
919 		/* XXX this is splsoftnet(), currently they are the same. */
920 		tdb = gettdbbysrcdst(0, &src, &dst, IPPROTO_TCP);
921 		if (tdb == NULL)
922 			return (EPERM);
923 
924 		if (tcp_signature(tdb, tp->pf, m, th, iphlen, 0,
925 		    mtod(m, caddr_t) + hdrlen - optlen + sigoff) < 0)
926 			return (EINVAL);
927 	}
928 #endif /* TCP_SIGNATURE */
929 
930 	/*
931 	 * Put TCP length in extended header, and then
932 	 * checksum extended header and data.
933 	 */
934 	switch (tp->pf) {
935 	case 0:	/*default to PF_INET*/
936 #ifdef INET
937 	case AF_INET:
938 		/* Defer checksumming until later (ip_output() or hardware) */
939 		m->m_pkthdr.csum |= M_TCPV4_CSUM_OUT;
940 		if (len + optlen)
941 			th->th_sum = in_cksum_addword(th->th_sum,
942 			    htons((u_int16_t)(len + optlen)));
943 		break;
944 #endif /* INET */
945 #ifdef INET6
946 	case AF_INET6:
947 		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
948 			hdrlen - sizeof(struct ip6_hdr) + len);
949 		break;
950 #endif /* INET6 */
951 	}
952 
953 	/*
954 	 * In transmit state, time the transmission and arrange for
955 	 * the retransmit.  In persist state, just set snd_max.
956 	 */
957 	if (tp->t_force == 0 || TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
958 		tcp_seq startseq = tp->snd_nxt;
959 
960 		/*
961 		 * Advance snd_nxt over sequence space of this segment.
962 		 */
963 		if (flags & (TH_SYN|TH_FIN)) {
964 			if (flags & TH_SYN)
965 				tp->snd_nxt++;
966 			if (flags & TH_FIN) {
967 				tp->snd_nxt++;
968 				tp->t_flags |= TF_SENTFIN;
969 			}
970 		}
971 #ifdef TCP_SACK
972 		if (tp->sack_enable) {
973 			if (sack_rxmit && (p->rxmit != tp->snd_nxt)) {
974 				goto timer;
975 			}
976 		}
977 #endif
978 		tp->snd_nxt += len;
979 		if (SEQ_GT(tp->snd_nxt, tp->snd_max)) {
980 			tp->snd_max = tp->snd_nxt;
981 			/*
982 			 * Time this transmission if not a retransmission and
983 			 * not currently timing anything.
984 			 */
985 			if (tp->t_rtttime == 0) {
986 				tp->t_rtttime = tcp_now;
987 				tp->t_rtseq = startseq;
988 				tcpstat.tcps_segstimed++;
989 			}
990 		}
991 
992 		/*
993 		 * Set retransmit timer if not currently set,
994 		 * and not doing an ack or a keep-alive probe.
995 		 * Initial value for retransmit timer is smoothed
996 		 * round-trip time + 2 * round-trip time variance.
997 		 * Initialize shift counter which is used for backoff
998 		 * of retransmit time.
999 		 */
1000 #ifdef TCP_SACK
1001  timer:
1002 		if (tp->sack_enable && sack_rxmit &&
1003 		    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1004 		    tp->snd_nxt != tp->snd_max) {
1005 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1006 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1007 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1008 				tp->t_rxtshift = 0;
1009 			}
1010 		}
1011 #endif
1012 
1013 		if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1014 		    tp->snd_nxt != tp->snd_una) {
1015 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1016 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1017 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1018 				tp->t_rxtshift = 0;
1019 			}
1020 		}
1021 	} else
1022 		if (SEQ_GT(tp->snd_nxt + len, tp->snd_max))
1023 			tp->snd_max = tp->snd_nxt + len;
1024 
1025 	/*
1026 	 * Trace.
1027 	 */
1028 	if (so->so_options & SO_DEBUG)
1029 		tcp_trace(TA_OUTPUT, tp->t_state, tp, mtod(m, caddr_t), 0,
1030 			len);
1031 
1032 	/*
1033 	 * Fill in IP length and desired time to live and
1034 	 * send to IP level.  There should be a better way
1035 	 * to handle ttl and tos; we could keep them in
1036 	 * the template, but need a way to checksum without them.
1037 	 */
1038 
1039 #ifdef TCP_ECN
1040 	/*
1041 	 * if peer is ECN capable, set the ECT bit in the IP header.
1042 	 * but don't set ECT for a pure ack, a retransmit or a window probe.
1043 	 */
1044 	needect = 0;
1045 	if (tcp_do_ecn && (tp->t_flags & TF_ECN_PERMIT)) {
1046 		if (len == 0 || SEQ_LT(tp->snd_nxt, tp->snd_max) ||
1047 		    (tp->t_force && len == 1)) {
1048 			/* don't set ECT */
1049 		} else {
1050 			needect = 1;
1051 			tcpstat.tcps_ecn_sndect++;
1052 		}
1053 	}
1054 #endif
1055 
1056 	switch (tp->pf) {
1057 	case 0:	/*default to PF_INET*/
1058 #ifdef INET
1059 	case AF_INET:
1060 		{
1061 			struct ip *ip;
1062 
1063 			ip = mtod(m, struct ip *);
1064 			ip->ip_len = htons(m->m_pkthdr.len);
1065 			ip->ip_ttl = tp->t_inpcb->inp_ip.ip_ttl;
1066 			ip->ip_tos = tp->t_inpcb->inp_ip.ip_tos;
1067 #ifdef TCP_ECN
1068 			if (needect)
1069 				ip->ip_tos |= IPTOS_ECN_ECT0;
1070 #endif
1071 		}
1072 		error = ip_output(m, tp->t_inpcb->inp_options,
1073 			&tp->t_inpcb->inp_route,
1074 			(ip_mtudisc ? IP_MTUDISC : 0) |
1075 				  (so->so_options & SO_DONTROUTE),
1076 			(void *)NULL, tp->t_inpcb);
1077 		break;
1078 #endif /* INET */
1079 #ifdef INET6
1080 	case AF_INET6:
1081 		{
1082 			struct ip6_hdr *ip6;
1083 
1084 			ip6 = mtod(m, struct ip6_hdr *);
1085 			ip6->ip6_plen = m->m_pkthdr.len -
1086 				sizeof(struct ip6_hdr);
1087 			ip6->ip6_nxt = IPPROTO_TCP;
1088 			ip6->ip6_hlim = in6_selecthlim(tp->t_inpcb, NULL);
1089 #ifdef TCP_ECN
1090 			if (needect)
1091 				ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
1092 #endif
1093 		}
1094 		error = ip6_output(m, tp->t_inpcb->inp_outputopts6,
1095 			  &tp->t_inpcb->inp_route6,
1096 			  (so->so_options & SO_DONTROUTE), NULL, NULL);
1097 		break;
1098 #endif /* INET6 */
1099 	}
1100 
1101 #if defined(TCP_SACK) && defined(TCP_FACK)
1102 	/* Update snd_awnd to reflect the new data that was sent.  */
1103 	tp->snd_awnd = tcp_seq_subtract(tp->snd_max, tp->snd_fack) +
1104 		tp->retran_data;
1105 #endif /* defined(TCP_SACK) && defined(TCP_FACK) */
1106 
1107 	if (error) {
1108 out:
1109 		if (error == ENOBUFS) {
1110 			tcp_quench(tp->t_inpcb, 0);
1111 			return (0);
1112 		}
1113 		if (error == EMSGSIZE) {
1114 			/*
1115 			 * ip_output() will have already fixed the route
1116 			 * for us.  tcp_mtudisc() will, as its last action,
1117 			 * initiate retransmission, so it is important to
1118 			 * not do so here.
1119 			 */
1120 			tcp_mtudisc(tp->t_inpcb, -1);
1121 			return (0);
1122 		}
1123 		if ((error == EHOSTUNREACH || error == ENETDOWN) &&
1124 		    TCPS_HAVERCVDSYN(tp->t_state)) {
1125 			tp->t_softerror = error;
1126 			return (0);
1127 		}
1128 
1129 		/* Restart the delayed ACK timer, if necessary. */
1130 		if (tp->t_flags & TF_DELACK)
1131 			TCP_RESTART_DELACK(tp);
1132 
1133 		return (error);
1134 	}
1135 	tcpstat.tcps_sndtotal++;
1136 	if (tp->t_flags & TF_DELACK)
1137 		tcpstat.tcps_delack++;
1138 
1139 	/*
1140 	 * Data sent (as far as we can tell).
1141 	 * If this advertises a larger window than any other segment,
1142 	 * then remember the size of the advertised window.
1143 	 * Any pending ACK has now been sent.
1144 	 */
1145 	if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
1146 		tp->rcv_adv = tp->rcv_nxt + win;
1147 	tp->last_ack_sent = tp->rcv_nxt;
1148 	tp->t_flags &= ~TF_ACKNOW;
1149 	TCP_CLEAR_DELACK(tp);
1150 #if defined(TCP_SACK)
1151 	if (sendalot && --maxburst)
1152 #else
1153 	if (sendalot)
1154 #endif
1155 		goto again;
1156 	return (0);
1157 }
1158 
1159 void
1160 tcp_setpersist(struct tcpcb *tp)
1161 {
1162 	int t = ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1;
1163 	int nticks;
1164 
1165 	if (TCP_TIMER_ISARMED(tp, TCPT_REXMT))
1166 		panic("tcp_output REXMT");
1167 	/*
1168 	 * Start/restart persistance timer.
1169 	 */
1170 	if (t < tp->t_rttmin)
1171 		t = tp->t_rttmin;
1172 	TCPT_RANGESET(nticks, t * tcp_backoff[tp->t_rxtshift],
1173 	    TCPTV_PERSMIN, TCPTV_PERSMAX);
1174 	TCP_TIMER_ARM(tp, TCPT_PERSIST, nticks);
1175 	if (tp->t_rxtshift < TCP_MAXRXTSHIFT)
1176 		tp->t_rxtshift++;
1177 }
1178