How timeout and retries works together in Istio?

Here is example of VirtualService, using both timeout and retries.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: sa-logic
spec:
  hosts:
    - sa-logic
  http:
  - route: 
    - destination: 
        host: sa-logic
        subset: v1
      weight: 50
    - destination: 
        host: sa-logic
        subset: v2
      weight: 50
    timeout: 8s
    retries:
      attempts: 3
      perTryTimeout: 3s # perTryTimeout (3s) is different from timeout above (8s)

How it works? The documentation does not provide clear answers to this question. I have three guesses:

1. Timeout always 8s (timeout overrides perTryTimeout).
2. Timeout always 3s (perTryTimeout overrides timeout).
3. The initial call's timeout is 8s, retry's timeout is 3s (contradicts the documentation. The docs says perTryTimeout includes the initial call and any retries).
4. Timeout per try always 3s (including initial call), but the total timeout for all attempts is 8s.