Back out tcp_timer.c:1.93 and associated changes that reimplemented the many

TCP timers as a single timer, but retain the API changes necessary to
reintroduce this change.  This will back out the source of at least two
reported problems: lock leaks in certain timer edge cases, and TCP timers
continuing to fire after a connection has closed (a bug previously fixed and
then reintroduced with the timer rewrite).

In a follow-up commit, some minor restylings and comment changes performed
after the TCP timer rewrite will be reapplied, and a further change to allow
the TCP timer rewrite to be added back without disturbing the ABI.  The new
design is believed to be a good thing, but the outstanding issues are
leading to significant stability/correctness problems that are holding
up 7.0.

This patch was generated by silby, but is being committed by proxy due to
poor network connectivity for silby this week.

Approved by:	re (kensmith)
Submitted by:	silby
Tested by:	rwatson, kris
Problems reported by:	peter, kris, others

1 files changed, 12 insertions, 12 deletions

diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index 2dd20e5..d907380 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -214,7 +214,8 @@ static void	tcp_isn_tick(void *);
  */
 struct tcpcb_mem {
 	struct	tcpcb		tcb;
-	struct	tcp_timer	tt;
+	struct	callout tcpcb_mem_rexmt, tcpcb_mem_persist, tcpcb_mem_keep;
+	struct	callout tcpcb_mem_2msl, tcpcb_mem_delack;
 };
 
 static uma_zone_t tcpcb_zone;
@@ -589,7 +590,6 @@ tcp_newtcpcb(struct inpcb *inp)
 	if (tm == NULL)
 		return (NULL);
 	tp = &tm->tcb;
-	tp->t_timers = &tm->tt;
 	/*	LIST_INIT(&tp->t_segq); */	/* XXX covered by M_ZERO */
 	tp->t_maxseg = tp->t_maxopd =
 #ifdef INET6
@@ -598,8 +598,11 @@ tcp_newtcpcb(struct inpcb *inp)
 		tcp_mssdflt;
 
 	/* Set up our timeouts. */
-	callout_init_mtx(&tp->t_timers->tt_timer, &inp->inp_mtx,
-	    CALLOUT_RETURNUNLOCKED);
+	callout_init(tp->tt_rexmt = &tm->tcpcb_mem_rexmt, CALLOUT_MPSAFE);
+	callout_init(tp->tt_persist = &tm->tcpcb_mem_persist, CALLOUT_MPSAFE);
+	callout_init(tp->tt_keep = &tm->tcpcb_mem_keep, CALLOUT_MPSAFE);
+	callout_init(tp->tt_2msl = &tm->tcpcb_mem_2msl, CALLOUT_MPSAFE);
+	callout_init(tp->tt_delack = &tm->tcpcb_mem_delack, CALLOUT_MPSAFE);
 
 	if (tcp_do_rfc1323)
 		tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
@@ -671,15 +674,12 @@ tcp_discardcb(struct tcpcb *tp)
 	/*
 	 * Make sure that all of our timers are stopped before we
 	 * delete the PCB.
-	 *
-	 * XXX: callout_stop() may race and a callout may already
-	 * try to obtain the INP_LOCK.  Only callout_drain() would
-	 * stop this but it would cause a LOR thus we can't use it.
-	 * The tcp_timer() function contains a lot of checks to
-	 * handle this case rather gracefully.
 	 */
-	tp->t_timers->tt_active = 0;
-	callout_stop(&tp->t_timers->tt_timer);
+	callout_stop(tp->tt_rexmt);
+	callout_stop(tp->tt_persist);
+	callout_stop(tp->tt_keep);
+	callout_stop(tp->tt_2msl);
+	callout_stop(tp->tt_delack);
 
 	/*
 	 * If we got enough samples through the srtt filter,