grpc 1.44.0.pre2 → 1.45.0

data/src/core/ext/filters/client_channel/retry_filter.cc

@@ -85,7 +85,6 @@
 // which batches need to be sent on the LB call for a given attempt.
 
 // TODO(roth): In subsequent PRs:
-// - add support for transparent retries (including initial metadata)
 // - implement hedging
 
 // By default, we buffer 256 KiB per RPC for retries.
@@ -145,7 +144,9 @@ class RetryFilter {
   RetryFilter(const grpc_channel_args* args, grpc_error_handle* error)
       : client_channel_(grpc_channel_args_find_pointer<ClientChannel>(
             args, GRPC_ARG_CLIENT_CHANNEL)),
-        per_rpc_retry_buffer_size_(GetMaxPerRpcRetryBufferSize(args)) {
+        per_rpc_retry_buffer_size_(GetMaxPerRpcRetryBufferSize(args)),
+        service_config_parser_index_(
+            internal::RetryServiceConfigParser::ParserIndex()) {
     // Get retry throttling parameters from service config.
     auto* service_config = grpc_channel_args_find_pointer<ServiceConfig>(
         args, GRPC_ARG_SERVICE_CONFIG_OBJ);
@@ -171,13 +172,19 @@ class RetryFilter {
     }
     std::string server_name(absl::StripPrefix(uri->path(), "/"));
     // Get throttling config for server_name.
-    retry_throttle_data_ = internal::ServerRetryThrottleMap::GetDataForServer(
-        server_name, config->max_milli_tokens(), config->milli_token_ratio());
+    retry_throttle_data_ =
+        internal::ServerRetryThrottleMap::Get()->GetDataForServer(
+            server_name, config->max_milli_tokens(),
+            config->milli_token_ratio());
   }
 
+  const RetryMethodConfig* GetRetryPolicy(
+      const grpc_call_context_element* context);
+
   ClientChannel* client_channel_;
   size_t per_rpc_retry_buffer_size_;
   RefCountedPtr<ServerRetryThrottleData> retry_throttle_data_;
+  const size_t service_config_parser_index_;
 };
 
 //
@@ -209,7 +216,7 @@ class RetryFilter::CallData {
   // State associated with each call attempt.
   class CallAttempt : public RefCounted<CallAttempt> {
    public:
-    explicit CallAttempt(CallData* calld);
+    CallAttempt(CallData* calld, bool is_transparent_retry);
     ~CallAttempt() override;
 
     bool lb_call_committed() const { return lb_call_committed_; }
@@ -371,9 +378,10 @@ class RetryFilter::CallData {
     void AddBatchForInternalRecvTrailingMetadata(
         CallCombinerClosureList* closures);
 
-    // Adds a batch to closures to cancel this call attempt.
-    void AddBatchForCancelOp(grpc_error_handle error,
-                             CallCombinerClosureList* closures);
+    // Adds a batch to closures to cancel this call attempt, if
+    // cancellation has not already been sent on the LB call.
+    void MaybeAddBatchForCancelOp(grpc_error_handle error,
+                                  CallCombinerClosureList* closures);
 
     // Adds batches for pending batches to closures.
     void AddBatchesForPendingBatches(CallCombinerClosureList* closures);
@@ -394,8 +402,8 @@ class RetryFilter::CallData {
     void MaybeSwitchToFastPath();
 
     // Returns true if the call should be retried.
-    bool ShouldRetry(absl::optional<grpc_status_code> status, bool is_lb_drop,
-                     absl::optional<grpc_millis> server_pushback_ms);
+    bool ShouldRetry(absl::optional<grpc_status_code> status,
+                     absl::optional<Duration> server_pushback_ms);
 
     // Abandons the call attempt.  Unrefs any deferred batches.
     void Abandon();
@@ -447,6 +455,7 @@ class RetryFilter::CallData {
     bool completed_recv_initial_metadata_ : 1;
     bool started_recv_trailing_metadata_ : 1;
     bool completed_recv_trailing_metadata_ : 1;
+    bool sent_cancel_stream_ : 1;
     // State for callback processing.
     RefCountedPtr<BatchData> recv_initial_metadata_ready_deferred_batch_;
     grpc_error_handle recv_initial_metadata_error_ = GRPC_ERROR_NONE;
@@ -504,16 +513,21 @@ class RetryFilter::CallData {
   void RetryCommit(CallAttempt* call_attempt);
 
   // Starts a timer to retry after appropriate back-off.
-  // If server_pushback_ms is nullopt, retry_backoff_ is used.
-  void StartRetryTimer(absl::optional<grpc_millis> server_pushback_ms);
+  // If server_pushback is nullopt, retry_backoff_ is used.
+  void StartRetryTimer(absl::optional<Duration> server_pushback);
 
   static void OnRetryTimer(void* arg, grpc_error_handle error);
   static void OnRetryTimerLocked(void* arg, grpc_error_handle error);
 
+  // Adds a closure to closures to start a transparent retry.
+  void AddClosureToStartTransparentRetry(CallCombinerClosureList* closures);
+  static void StartTransparentRetry(void* arg, grpc_error_handle error);
+
   OrphanablePtr<ClientChannel::LoadBalancedCall> CreateLoadBalancedCall(
-      ConfigSelector::CallDispatchController* call_dispatch_controller);
+      ConfigSelector::CallDispatchController* call_dispatch_controller,
+      bool is_transparent_retry);
 
-  void CreateCallAttempt();
+  void CreateCallAttempt(bool is_transparent_retry);
 
   RetryFilter* chand_;
   grpc_polling_entity* pollent_;
@@ -522,7 +536,7 @@ class RetryFilter::CallData {
   BackOff retry_backoff_;
 
   grpc_slice path_;  // Request path.
-  grpc_millis deadline_;
+  Timestamp deadline_;
   Arena* arena_;
   grpc_call_stack* owning_call_;
   CallCombiner* call_combiner_;
@@ -556,6 +570,8 @@ class RetryFilter::CallData {
   // Retry state.
   bool retry_committed_ : 1;
   bool retry_timer_pending_ : 1;
+  bool retry_codepath_started_ : 1;
+  bool sent_transparent_retry_not_seen_by_server_ : 1;
   int num_attempts_completed_ = 0;
   grpc_timer retry_timer_;
   grpc_closure retry_closure_;
@@ -648,7 +664,8 @@ class RetryFilter::CallData::CallStackDestructionBarrier
 // RetryFilter::CallData::CallAttempt
 //
 
-RetryFilter::CallData::CallAttempt::CallAttempt(CallData* calld)
+RetryFilter::CallData::CallAttempt::CallAttempt(CallData* calld,
+                                                bool is_transparent_retry)
     : RefCounted(GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace) ? "CallAttempt"
                                                            : nullptr),
       calld_(calld),
@@ -662,9 +679,11 @@ RetryFilter::CallData::CallAttempt::CallAttempt(CallData* calld)
       completed_recv_initial_metadata_(false),
       started_recv_trailing_metadata_(false),
       completed_recv_trailing_metadata_(false),
+      sent_cancel_stream_(false),
       seen_recv_trailing_metadata_from_surface_(false),
       abandoned_(false) {
-  lb_call_ = calld->CreateLoadBalancedCall(&attempt_dispatch_controller_);
+  lb_call_ = calld->CreateLoadBalancedCall(&attempt_dispatch_controller_,
+                                           is_transparent_retry);
   if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
     gpr_log(GPR_INFO, "chand=%p calld=%p attempt=%p: create lb_call=%p",
             calld->chand_, calld, this, lb_call_.get());
@@ -672,7 +691,7 @@ RetryFilter::CallData::CallAttempt::CallAttempt(CallData* calld)
   // If per_attempt_recv_timeout is set, start a timer.
   if (calld->retry_policy_ != nullptr &&
       calld->retry_policy_->per_attempt_recv_timeout().has_value()) {
-    grpc_millis per_attempt_recv_deadline =
+    Timestamp per_attempt_recv_deadline =
         ExecCtx::Get()->Now() +
         *calld->retry_policy_->per_attempt_recv_timeout();
     if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
@@ -680,7 +699,7 @@ RetryFilter::CallData::CallAttempt::CallAttempt(CallData* calld)
               "chand=%p calld=%p attempt=%p: per-attempt timeout in %" PRId64
               " ms",
               calld->chand_, calld, this,
-              *calld->retry_policy_->per_attempt_recv_timeout());
+              calld->retry_policy_->per_attempt_recv_timeout()->millis());
     }
     // Schedule retry after computed delay.
     GRPC_CLOSURE_INIT(&on_per_attempt_recv_timer_, OnPerAttemptRecvTimer, this,
@@ -872,8 +891,13 @@ void RetryFilter::CallData::CallAttempt::
                      "starting internal recv_trailing_metadata", closures);
 }
 
-void RetryFilter::CallData::CallAttempt::AddBatchForCancelOp(
+void RetryFilter::CallData::CallAttempt::MaybeAddBatchForCancelOp(
     grpc_error_handle error, CallCombinerClosureList* closures) {
+  if (sent_cancel_stream_) {
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  sent_cancel_stream_ = true;
   BatchData* cancel_batch_data = CreateBatch(1, /*set_on_complete=*/true);
   cancel_batch_data->AddCancelStreamOp(error);
   AddClosureForBatch(cancel_batch_data->batch(),
@@ -924,7 +948,10 @@ void RetryFilter::CallData::CallAttempt::AddBatchesForPendingBatches(
       ++num_callbacks;
     }
     if (batch->recv_message) {
-      if (completed_recv_message_count_ < started_recv_message_count_) {
+      // Skip if the op is already in flight, or if it has already completed
+      // but the completion has not yet been sent to the surface.
+      if (completed_recv_message_count_ < started_recv_message_count_ ||
+          recv_message_ready_deferred_batch_ != nullptr) {
         continue;
       }
       ++num_callbacks;
@@ -1054,16 +1081,14 @@ void RetryFilter::CallData::CallAttempt::StartRetriableBatches() {
 void RetryFilter::CallData::CallAttempt::CancelFromSurface(
     grpc_transport_stream_op_batch* cancel_batch) {
   MaybeCancelPerAttemptRecvTimer();
+  Abandon();
   // Propagate cancellation to LB call.
   lb_call_->StartTransportStreamOpBatch(cancel_batch);
 }
 
 bool RetryFilter::CallData::CallAttempt::ShouldRetry(
-    absl::optional<grpc_status_code> status, bool is_lb_drop,
-    absl::optional<grpc_millis> server_pushback_ms) {
-  // LB drops always inhibit retries.
-  if (is_lb_drop) return false;
-  // TODO(roth): Handle transparent retries here.
+    absl::optional<grpc_status_code> status,
+    absl::optional<Duration> server_pushback) {
   // If no retry policy, don't retry.
   if (calld_->retry_policy_ == nullptr) return false;
   // Check status.
@@ -1126,8 +1151,8 @@ bool RetryFilter::CallData::CallAttempt::ShouldRetry(
     return false;
   }
   // Check server push-back.
-  if (server_pushback_ms.has_value()) {
-    if (*server_pushback_ms < 0) {
+  if (server_pushback.has_value()) {
+    if (*server_pushback < Duration::Zero()) {
       if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
         gpr_log(GPR_INFO,
                 "chand=%p calld=%p attempt=%p: not retrying due to server "
@@ -1141,7 +1166,7 @@ bool RetryFilter::CallData::CallAttempt::ShouldRetry(
             GPR_INFO,
             "chand=%p calld=%p attempt=%p: server push-back: retry in %" PRIu64
             " ms",
-            calld_->chand_, calld_, this, *server_pushback_ms);
+            calld_->chand_, calld_, this, server_pushback->millis());
       }
     }
   }
@@ -1170,23 +1195,23 @@ void RetryFilter::CallData::CallAttempt::Abandon() {
       !seen_recv_trailing_metadata_from_surface_) {
     recv_trailing_metadata_internal_batch_.reset(
         DEBUG_LOCATION,
-        "internal recv_trailing_metadata completed before that op was "
-        "started from the surface");
+        "unref internal recv_trailing_metadata_ready batch; attempt abandoned");
   }
   GRPC_ERROR_UNREF(recv_trailing_metadata_error_);
   recv_trailing_metadata_error_ = GRPC_ERROR_NONE;
   recv_initial_metadata_ready_deferred_batch_.reset(
       DEBUG_LOCATION,
-      "unref deferred recv_initial_metadata_ready batch due to retry");
+      "unref deferred recv_initial_metadata_ready batch; attempt abandoned");
   GRPC_ERROR_UNREF(recv_initial_metadata_error_);
   recv_initial_metadata_error_ = GRPC_ERROR_NONE;
   recv_message_ready_deferred_batch_.reset(
-      DEBUG_LOCATION, "unref deferred recv_message_ready batch due to retry");
+      DEBUG_LOCATION,
+      "unref deferred recv_message_ready batch; attempt abandoned");
   GRPC_ERROR_UNREF(recv_message_error_);
   recv_message_error_ = GRPC_ERROR_NONE;
   for (auto& on_complete_deferred_batch : on_complete_deferred_batches_) {
     on_complete_deferred_batch.batch.reset(
-        DEBUG_LOCATION, "unref deferred on_complete batch due to retry");
+        DEBUG_LOCATION, "unref deferred on_complete batch; attempt abandoned");
     GRPC_ERROR_UNREF(on_complete_deferred_batch.error);
   }
   on_complete_deferred_batches_.clear();
@@ -1221,19 +1246,18 @@ void RetryFilter::CallData::CallAttempt::OnPerAttemptRecvTimerLocked(
     // Cancel this attempt.
     // TODO(roth): When implementing hedging, we should not cancel the
     // current attempt.
-    call_attempt->AddBatchForCancelOp(
+    call_attempt->MaybeAddBatchForCancelOp(
         grpc_error_set_int(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                "retry perAttemptRecvTimeout exceeded"),
                            GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_CANCELLED),
         &closures);
     // Check whether we should retry.
-    if (call_attempt->ShouldRetry(
-            /*status=*/absl::nullopt, /*is_lb_drop=*/false,
-            /*server_pushback_ms=*/absl::nullopt)) {
+    if (call_attempt->ShouldRetry(/*status=*/absl::nullopt,
+                                  /*server_pushback_ms=*/absl::nullopt)) {
       // Mark current attempt as abandoned.
       call_attempt->Abandon();
       // We are retrying.  Start backoff timer.
-      calld->StartRetryTimer(/*server_pushback_ms=*/absl::nullopt);
+      calld->StartRetryTimer(/*server_pushback=*/absl::nullopt);
     } else {
       // Not retrying, so commit the call.
       calld->RetryCommit(call_attempt);
@@ -1401,7 +1425,8 @@ void RetryFilter::CallData::CallAttempt::BatchData::RecvInitialMetadataReady(
       call_attempt->recv_initial_metadata_error_ = GRPC_ERROR_REF(error);
       CallCombinerClosureList closures;
       if (error != GRPC_ERROR_NONE) {
-        call_attempt->AddBatchForCancelOp(GRPC_ERROR_REF(error), &closures);
+        call_attempt->MaybeAddBatchForCancelOp(GRPC_ERROR_REF(error),
+                                               &closures);
       }
       if (!call_attempt->started_recv_trailing_metadata_) {
         // recv_trailing_metadata not yet started by application; start it
@@ -1498,7 +1523,8 @@ void RetryFilter::CallData::CallAttempt::BatchData::RecvMessageReady(
       call_attempt->recv_message_error_ = GRPC_ERROR_REF(error);
       CallCombinerClosureList closures;
       if (error != GRPC_ERROR_NONE) {
-        call_attempt->AddBatchForCancelOp(GRPC_ERROR_REF(error), &closures);
+        call_attempt->MaybeAddBatchForCancelOp(GRPC_ERROR_REF(error),
+                                               &closures);
       }
       if (!call_attempt->started_recv_trailing_metadata_) {
         // recv_trailing_metadata not yet started by application; start it
@@ -1527,12 +1553,13 @@ void RetryFilter::CallData::CallAttempt::BatchData::RecvMessageReady(
 
 namespace {
 
-// Sets *status, *server_pushback_ms, and *is_lb_drop based on md_batch
+// Sets *status, *server_pushback, and *is_lb_drop based on md_batch
 // and error.
-void GetCallStatus(grpc_millis deadline, grpc_metadata_batch* md_batch,
-                   grpc_error_handle error, grpc_status_code* status,
-                   absl::optional<grpc_millis>* server_pushback_ms,
-                   bool* is_lb_drop) {
+void GetCallStatus(
+    Timestamp deadline, grpc_metadata_batch* md_batch, grpc_error_handle error,
+    grpc_status_code* status, absl::optional<Duration>* server_pushback,
+    bool* is_lb_drop,
+    absl::optional<GrpcStreamNetworkState::ValueType>* stream_network_state) {
   if (error != GRPC_ERROR_NONE) {
     grpc_error_get_status(error, deadline, status, nullptr, nullptr, nullptr);
     intptr_t value = 0;
@@ -1542,8 +1569,9 @@ void GetCallStatus(grpc_millis deadline, grpc_metadata_batch* md_batch,
     }
   } else {
     *status = *md_batch->get(GrpcStatusMetadata());
-    *server_pushback_ms = md_batch->get(GrpcRetryPushbackMsMetadata());
   }
+  *server_pushback = md_batch->get(GrpcRetryPushbackMsMetadata());
+  *stream_network_state = md_batch->get(GrpcStreamNetworkState());
   GRPC_ERROR_UNREF(error);
 }
 
@@ -1674,37 +1702,72 @@ void RetryFilter::CallData::CallAttempt::BatchData::RecvTrailingMetadataReady(
   call_attempt->MaybeCancelPerAttemptRecvTimer();
   // Get the call's status and check for server pushback metadata.
   grpc_status_code status = GRPC_STATUS_OK;
-  absl::optional<grpc_millis> server_pushback_ms;
+  absl::optional<Duration> server_pushback;
+  bool is_lb_drop = false;
+  absl::optional<GrpcStreamNetworkState::ValueType> stream_network_state;
   grpc_metadata_batch* md_batch =
       batch_data->batch_.payload->recv_trailing_metadata.recv_trailing_metadata;
-  bool is_lb_drop = false;
   GetCallStatus(calld->deadline_, md_batch, GRPC_ERROR_REF(error), &status,
-                &server_pushback_ms, &is_lb_drop);
+                &server_pushback, &is_lb_drop, &stream_network_state);
   if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
-    gpr_log(
-        GPR_INFO,
-        "chand=%p calld=%p attempt=%p: call finished, status=%s is_lb_drop=%d",
-        calld->chand_, calld, call_attempt, grpc_status_code_to_string(status),
-        is_lb_drop);
+    gpr_log(GPR_INFO,
+            "chand=%p calld=%p attempt=%p: call finished, status=%s "
+            "server_pushback=%s is_lb_drop=%d stream_network_state=%s",
+            calld->chand_, calld, call_attempt,
+            grpc_status_code_to_string(status),
+            server_pushback.has_value() ? server_pushback->ToString().c_str()
+                                        : "N/A",
+            is_lb_drop,
+            stream_network_state.has_value()
+                ? absl::StrCat(*stream_network_state).c_str()
+                : "N/A");
   }
   // Check if we should retry.
-  if (call_attempt->ShouldRetry(status, is_lb_drop, server_pushback_ms)) {
-    // Start retry timer.
-    calld->StartRetryTimer(server_pushback_ms);
-    // Cancel call attempt.
-    CallCombinerClosureList closures;
-    call_attempt->AddBatchForCancelOp(
-        error == GRPC_ERROR_NONE
-            ? grpc_error_set_int(
-                  GRPC_ERROR_CREATE_FROM_STATIC_STRING("call attempt failed"),
-                  GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_CANCELLED)
-            : GRPC_ERROR_REF(error),
-        &closures);
-    // Record that this attempt has been abandoned.
-    call_attempt->Abandon();
-    // Yields call combiner.
-    closures.RunClosures(calld->call_combiner_);
-    return;
+  if (!is_lb_drop) {  // Never retry on LB drops.
+    enum { kNoRetry, kTransparentRetry, kConfigurableRetry } retry = kNoRetry;
+    // Handle transparent retries.
+    if (stream_network_state.has_value() && !calld->retry_committed_) {
+      // If not sent on wire, then always retry.
+      // If sent on wire but not seen by server, retry exactly once.
+      if (*stream_network_state == GrpcStreamNetworkState::kNotSentOnWire) {
+        retry = kTransparentRetry;
+      } else if (*stream_network_state ==
+                     GrpcStreamNetworkState::kNotSeenByServer &&
+                 !calld->sent_transparent_retry_not_seen_by_server_) {
+        calld->sent_transparent_retry_not_seen_by_server_ = true;
+        retry = kTransparentRetry;
+      }
+    }
+    // If not transparently retrying, check for configurable retry.
+    if (retry == kNoRetry &&
+        call_attempt->ShouldRetry(status, server_pushback)) {
+      retry = kConfigurableRetry;
+    }
+    // If we're retrying, do so.
+    if (retry != kNoRetry) {
+      CallCombinerClosureList closures;
+      // Cancel call attempt.
+      call_attempt->MaybeAddBatchForCancelOp(
+          error == GRPC_ERROR_NONE
+              ? grpc_error_set_int(
+                    GRPC_ERROR_CREATE_FROM_STATIC_STRING("call attempt failed"),
+                    GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_CANCELLED)
+              : GRPC_ERROR_REF(error),
+          &closures);
+      // For transparent retries, add a closure to immediately start a new
+      // call attempt.
+      // For configurable retries, start retry timer.
+      if (retry == kTransparentRetry) {
+        calld->AddClosureToStartTransparentRetry(&closures);
+      } else {
+        calld->StartRetryTimer(server_pushback);
+      }
+      // Record that this attempt has been abandoned.
+      call_attempt->Abandon();
+      // Yields call combiner.
+      closures.RunClosures(calld->call_combiner_);
+      return;
+    }
   }
   // Not retrying, so commit the call.
   calld->RetryCommit(call_attempt);
@@ -1812,7 +1875,7 @@ void RetryFilter::CallData::CallAttempt::BatchData::OnComplete(
     call_attempt->on_complete_deferred_batches_.emplace_back(
         std::move(batch_data), GRPC_ERROR_REF(error));
     CallCombinerClosureList closures;
-    call_attempt->AddBatchForCancelOp(GRPC_ERROR_REF(error), &closures);
+    call_attempt->MaybeAddBatchForCancelOp(GRPC_ERROR_REF(error), &closures);
     if (!call_attempt->started_recv_trailing_metadata_) {
       // recv_trailing_metadata not yet started by application; start it
       // ourselves to get status.
@@ -2035,33 +2098,33 @@ void RetryFilter::CallData::SetPollent(grpc_call_element* elem,
 // CallData implementation
 //
 
-const RetryMethodConfig* GetRetryPolicy(
+const RetryMethodConfig* RetryFilter::GetRetryPolicy(
     const grpc_call_context_element* context) {
   if (context == nullptr) return nullptr;
   auto* svc_cfg_call_data = static_cast<ServiceConfigCallData*>(
       context[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].value);
   if (svc_cfg_call_data == nullptr) return nullptr;
   return static_cast<const RetryMethodConfig*>(
-      svc_cfg_call_data->GetMethodParsedConfig(
-          RetryServiceConfigParser::ParserIndex()));
+      svc_cfg_call_data->GetMethodParsedConfig(service_config_parser_index_));
 }
 
 RetryFilter::CallData::CallData(RetryFilter* chand,
                                 const grpc_call_element_args& args)
     : chand_(chand),
       retry_throttle_data_(chand->retry_throttle_data_),
-      retry_policy_(GetRetryPolicy(args.context)),
+      retry_policy_(chand->GetRetryPolicy(args.context)),
       retry_backoff_(
           BackOff::Options()
               .set_initial_backoff(retry_policy_ == nullptr
-                                       ? 0
+                                       ? Duration::Zero()
                                        : retry_policy_->initial_backoff())
               .set_multiplier(retry_policy_ == nullptr
                                   ? 0
                                   : retry_policy_->backoff_multiplier())
               .set_jitter(RETRY_BACKOFF_JITTER)
-              .set_max_backoff(
-                  retry_policy_ == nullptr ? 0 : retry_policy_->max_backoff())),
+              .set_max_backoff(retry_policy_ == nullptr
+                                   ? Duration::Zero()
+                                   : retry_policy_->max_backoff())),
       path_(grpc_slice_ref_internal(args.path)),
       deadline_(args.deadline),
       arena_(args.arena),
@@ -2074,9 +2137,12 @@ RetryFilter::CallData::CallData(RetryFilter* chand,
       pending_send_message_(false),
       pending_send_trailing_metadata_(false),
       retry_committed_(false),
-      retry_timer_pending_(false) {}
+      retry_timer_pending_(false),
+      retry_codepath_started_(false),
+      sent_transparent_retry_not_seen_by_server_(false) {}
 
 RetryFilter::CallData::~CallData() {
+  FreeAllCachedSendOpData();
   grpc_slice_unref_internal(path_);
   // Make sure there are no remaining pending batches.
   for (size_t i = 0; i < GPR_ARRAY_SIZE(pending_batches_); ++i) {
@@ -2087,19 +2153,36 @@ RetryFilter::CallData::~CallData() {
 
 void RetryFilter::CallData::StartTransportStreamOpBatch(
     grpc_transport_stream_op_batch* batch) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
+    gpr_log(GPR_INFO, "chand=%p calld=%p: batch started from surface: %s",
+            chand_, this, grpc_transport_stream_op_batch_string(batch).c_str());
+  }
   // If we have an LB call, delegate to the LB call.
   if (committed_call_ != nullptr) {
     // Note: This will release the call combiner.
     committed_call_->StartTransportStreamOpBatch(batch);
     return;
   }
+  // If we were previously cancelled from the surface, fail this
+  // batch immediately.
+  if (cancelled_from_surface_ != GRPC_ERROR_NONE) {
+    // Note: This will release the call combiner.
+    grpc_transport_stream_op_batch_finish_with_failure(
+        batch, GRPC_ERROR_REF(cancelled_from_surface_), call_combiner_);
+    return;
+  }
   // Handle cancellation.
   if (GPR_UNLIKELY(batch->cancel_stream)) {
-    grpc_error_handle cancel_error = batch->payload->cancel_stream.cancel_error;
+    // Save cancel_error in case subsequent batches are started.
+    GRPC_ERROR_UNREF(cancelled_from_surface_);
+    cancelled_from_surface_ =
+        GRPC_ERROR_REF(batch->payload->cancel_stream.cancel_error);
     if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
       gpr_log(GPR_INFO, "chand=%p calld=%p: cancelled from surface: %s", chand_,
-              this, grpc_error_std_string(cancel_error).c_str());
+              this, grpc_error_std_string(cancelled_from_surface_).c_str());
     }
+    // Fail any pending batches.
+    PendingBatchesFail(GRPC_ERROR_REF(cancelled_from_surface_));
     // If we have a current call attempt, commit the call, then send
     // the cancellation down to that attempt.  When the call fails, it
     // will not be retried, because we have committed it here.
@@ -2115,10 +2198,7 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
       call_attempt_->CancelFromSurface(batch);
       return;
     }
-    // Save cancel_error in case subsequent batches are started.
-    GRPC_ERROR_UNREF(cancelled_from_surface_);
-    cancelled_from_surface_ = GRPC_ERROR_REF(cancel_error);
-    // Cancel retry timer.
+    // Cancel retry timer if needed.
     if (retry_timer_pending_) {
       if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
         gpr_log(GPR_INFO, "chand=%p calld=%p: cancelling retry timer", chand_,
@@ -2128,11 +2208,11 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
       grpc_timer_cancel(&retry_timer_);
       FreeAllCachedSendOpData();
     }
-    // Fail pending batches.
-    PendingBatchesFail(GRPC_ERROR_REF(cancel_error));
+    // We have no call attempt, so there's nowhere to send the cancellation
+    // batch.  Return it back to the surface immediately.
     // Note: This will release the call combiner.
     grpc_transport_stream_op_batch_finish_with_failure(
-        batch, GRPC_ERROR_REF(cancel_error), call_combiner_);
+        batch, GRPC_ERROR_REF(cancelled_from_surface_), call_combiner_);
     return;
   }
   // Add the batch to the pending list.
@@ -2146,20 +2226,6 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
   }
   // If we do not yet have a call attempt, create one.
   if (call_attempt_ == nullptr) {
-    // If we were previously cancelled from the surface, cancel this
-    // batch instead of creating a call attempt.
-    if (cancelled_from_surface_ != GRPC_ERROR_NONE) {
-      PendingBatchClear(pending);
-      // Note: This will release the call combiner.
-      grpc_transport_stream_op_batch_finish_with_failure(
-          batch, GRPC_ERROR_REF(cancelled_from_surface_), call_combiner_);
-      return;
-    }
-    // If there is no retry policy, then commit retries immediately.
-    // This ensures that the code below will always jump to the fast path.
-    // TODO(roth): Remove this special case when we implement
-    // transparent retries.
-    if (retry_policy_ == nullptr) retry_committed_ = true;
     // If this is the first batch and retries are already committed
     // (e.g., if this batch put the call above the buffer size limit), then
     // immediately create an LB call and delegate the batch to it.  This
@@ -2175,7 +2241,7 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
     // We also skip this optimization if perAttemptRecvTimeout is set in the
     // retry policy, because we need the code in CallAttempt to handle
     // the associated timer.
-    if (num_attempts_completed_ == 0 && retry_committed_ &&
+    if (!retry_codepath_started_ && retry_committed_ &&
         (retry_policy_ == nullptr ||
          !retry_policy_->per_attempt_recv_timeout().has_value())) {
       if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
@@ -2189,7 +2255,8 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
           static_cast<ClientChannelServiceConfigCallData*>(
               call_context_[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].value);
       committed_call_ = CreateLoadBalancedCall(
-          service_config_call_data->call_dispatch_controller());
+          service_config_call_data->call_dispatch_controller(),
+          /*is_transparent_retry=*/false);
       committed_call_->StartTransportStreamOpBatch(batch);
       return;
     }
@@ -2200,7 +2267,8 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
       gpr_log(GPR_INFO, "chand=%p calld=%p: creating call attempt", chand_,
               this);
     }
-    CreateCallAttempt();
+    retry_codepath_started_ = true;
+    CreateCallAttempt(/*is_transparent_retry=*/false);
     return;
   }
   // Send batches to call attempt.
@@ -2213,7 +2281,8 @@ void RetryFilter::CallData::StartTransportStreamOpBatch(
 
 OrphanablePtr<ClientChannel::LoadBalancedCall>
 RetryFilter::CallData::CreateLoadBalancedCall(
-    ConfigSelector::CallDispatchController* call_dispatch_controller) {
+    ConfigSelector::CallDispatchController* call_dispatch_controller,
+    bool is_transparent_retry) {
   grpc_call_element_args args = {owning_call_, nullptr,          call_context_,
                                  path_,        /*start_time=*/0, deadline_,
                                  arena_,       call_combiner_};
@@ -2222,13 +2291,11 @@ RetryFilter::CallData::CreateLoadBalancedCall(
       // This callback holds a ref to the CallStackDestructionBarrier
       // object until the LB call is destroyed.
       call_stack_destruction_barrier_->MakeLbCallDestructionClosure(this),
-      call_dispatch_controller,
-      // TODO(roth): Change this when we support transparent retries.
-      /*is_transparent_retry=*/false);
+      call_dispatch_controller, is_transparent_retry);
 }
 
-void RetryFilter::CallData::CreateCallAttempt() {
-  call_attempt_ = MakeRefCounted<CallAttempt>(this);
+void RetryFilter::CallData::CreateCallAttempt(bool is_transparent_retry) {
+  call_attempt_ = MakeRefCounted<CallAttempt>(this, is_transparent_retry);
   call_attempt_->StartRetriableBatches();
 }
 
@@ -2274,12 +2341,15 @@ void RetryFilter::CallData::FreeCachedSendInitialMetadata() {
 }
 
 void RetryFilter::CallData::FreeCachedSendMessage(size_t idx) {
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
-    gpr_log(GPR_INFO,
-            "chand=%p calld=%p: destroying send_messages[%" PRIuPTR "]", chand_,
-            this, idx);
+  if (send_messages_[idx] != nullptr) {
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
+      gpr_log(GPR_INFO,
+              "chand=%p calld=%p: destroying send_messages[%" PRIuPTR "]",
+              chand_, this, idx);
+    }
+    send_messages_[idx]->Destroy();
+    send_messages_[idx] = nullptr;
   }
-  send_messages_[idx]->Destroy();
 }
 
 void RetryFilter::CallData::FreeCachedSendTrailingMetadata() {
@@ -2484,14 +2554,14 @@ void RetryFilter::CallData::RetryCommit(CallAttempt* call_attempt) {
 }
 
 void RetryFilter::CallData::StartRetryTimer(
-    absl::optional<grpc_millis> server_pushback_ms) {
+    absl::optional<Duration> server_pushback) {
   // Reset call attempt.
   call_attempt_.reset(DEBUG_LOCATION, "StartRetryTimer");
   // Compute backoff delay.
-  grpc_millis next_attempt_time;
-  if (server_pushback_ms.has_value()) {
-    GPR_ASSERT(*server_pushback_ms >= 0);
-    next_attempt_time = ExecCtx::Get()->Now() + *server_pushback_ms;
+  Timestamp next_attempt_time;
+  if (server_pushback.has_value()) {
+    GPR_ASSERT(*server_pushback >= Duration::Zero());
+    next_attempt_time = ExecCtx::Get()->Now() + *server_pushback;
     retry_backoff_.Reset();
   } else {
     next_attempt_time = retry_backoff_.NextAttemptTime();
@@ -2499,7 +2569,7 @@ void RetryFilter::CallData::StartRetryTimer(
   if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
     gpr_log(GPR_INFO,
             "chand=%p calld=%p: retrying failed call in %" PRId64 " ms", chand_,
-            this, next_attempt_time - ExecCtx::Get()->Now());
+            this, (next_attempt_time - ExecCtx::Get()->Now()).millis());
   }
   // Schedule retry after computed delay.
   GRPC_CLOSURE_INIT(&retry_closure_, OnRetryTimer, this, nullptr);
@@ -2520,17 +2590,41 @@ void RetryFilter::CallData::OnRetryTimerLocked(void* arg,
   auto* calld = static_cast<CallData*>(arg);
   if (error == GRPC_ERROR_NONE && calld->retry_timer_pending_) {
     calld->retry_timer_pending_ = false;
-    calld->CreateCallAttempt();
+    calld->CreateCallAttempt(/*is_transparent_retry=*/false);
   } else {
     GRPC_CALL_COMBINER_STOP(calld->call_combiner_, "retry timer cancelled");
   }
   GRPC_CALL_STACK_UNREF(calld->owning_call_, "OnRetryTimer");
 }
 
+void RetryFilter::CallData::AddClosureToStartTransparentRetry(
+    CallCombinerClosureList* closures) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_retry_trace)) {
+    gpr_log(GPR_INFO, "chand=%p calld=%p: scheduling transparent retry", chand_,
+            this);
+  }
+  GRPC_CALL_STACK_REF(owning_call_, "OnRetryTimer");
+  GRPC_CLOSURE_INIT(&retry_closure_, StartTransparentRetry, this, nullptr);
+  closures->Add(&retry_closure_, GRPC_ERROR_NONE, "start transparent retry");
+}
+
+void RetryFilter::CallData::StartTransparentRetry(void* arg,
+                                                  grpc_error_handle /*error*/) {
+  auto* calld = static_cast<CallData*>(arg);
+  if (calld->cancelled_from_surface_ == GRPC_ERROR_NONE) {
+    calld->CreateCallAttempt(/*is_transparent_retry=*/true);
+  } else {
+    GRPC_CALL_COMBINER_STOP(calld->call_combiner_,
+                            "call cancelled before transparent retry");
+  }
+  GRPC_CALL_STACK_UNREF(calld->owning_call_, "OnRetryTimer");
+}
+
 }  // namespace
 
 const grpc_channel_filter kRetryFilterVtable = {
     RetryFilter::CallData::StartTransportStreamOpBatch,
+    nullptr,
     RetryFilter::StartTransportOp,
     sizeof(RetryFilter::CallData),
     RetryFilter::CallData::Init,