9c38274551cf9c9d1543fccc821c8650710f64e2
[sip-router] / modules / tm / timer.c
1 /*
2  * $Id$
3  *
4  *
5  * Copyright (C) 2001-2003 FhG Fokus
6  *
7  * This file is part of ser, a free SIP server.
8  *
9  * ser is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version
13  *
14  * For a license to use the ser software under conditions
15  * other than those described here, or to purchase support for this
16  * software, please contact iptel.org by e-mail at the following addresses:
17  *    info@iptel.org
18  *
19  * ser is distributed in the hope that it will be useful,
20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  * GNU General Public License for more details.
23  *
24  * You should have received a copy of the GNU General Public License 
25  * along with this program; if not, write to the Free Software 
26  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
27  */
28
29
30 /* 
31   timer.c is where we implement TM timers. It has been designed
32   for high performance using some techniques of which timer users
33   need to be aware.
34
35         One technique is "fixed-timer-length". We maintain separate 
36         timer lists, all of them include elements of the same time
37         to fire. That allows *appending* new events to the list as
38         opposed to inserting them by time, which is costly due to
39         searching time spent in a mutex. The performance benefit is
40         noticeable. The limitation is you need a new timer list for
41         each new timer length.
42
43         Another technique is the timer process slices off expired elements
44         from the list in a mutex, but executes the timer after the mutex
45         is left. That saves time greatly as whichever process wants to
46         add/remove a timer, it does not have to wait until the current
47         list is processed. However, be aware the timers may hit in a delayed
48         manner; you have no guarantee in your process that after resetting a timer, 
49         it will no more hit. It might have been removed by timer process,
50     and is waiting to be executed.  The following example shows it:
51
52                         PROCESS1                                TIMER PROCESS
53
54         0.                                                              timer hits, it is removed from queue and
55                                                                         about to be executed
56         1.      process1 decides to
57                 reset the timer 
58         2.                                                              timer is executed now
59         3.      if the process1 naively
60                 thinks the timer could not 
61                 have been executed after 
62                 resetting the timer, it is
63                 WRONG -- it was (step 2.)
64
65         So be careful when writing the timer handlers. Currently defined timers 
66         don't hurt if they hit delayed, I hope at least. Retransmission timer 
67         may results in a useless retransmission -- not too bad. FR timer not too
68         bad either as timer processing uses a REPLY mutex making it safe to other
69         processing affecting transaction state. Wait timer not bad either -- processes
70         putting a transaction on wait don't do anything with it anymore.
71
72                 Example when it does not hurt:
73
74                         P1                                              TIMER
75         0.                                                              RETR timer removed from list and
76                                                                         scheduled for execution
77         1. 200/BYE received->
78            reset RETR, put_on_wait
79         2.                                                              RETR timer executed -- too late but it does
80                                                                         not hurt
81         3.                                                              WAIT handler executed
82
83         The rule of thumb is don't touch data you put under a timer. Create data,
84     put them under a timer, and let them live until they are safely destroyed from
85     wait/delete timer.  The only safe place to manipulate the data is 
86     from timer process in which delayed timers cannot hit (all timers are
87     processed sequentially).
88
89         A "bad example" -- rewriting content of retransmission buffer
90         in an unprotected way is bad because a delayed retransmission timer might 
91         hit. Thats why our reply retransmission procedure is enclosed in 
92         a REPLY_LOCK.
93
94 */
95 /*
96  * History:
97  * --------
98  *  2003-06-27  timers are not unlinked if timerlist is 0 (andrei)
99  *  2004-02-13  t->is_invite, t->local, t->noisy_ctimer replaced;
100  *              timer_link.payload removed (bogdan)
101  *  2005-10-03  almost completely rewritten to use the new timers (andrei)
102  *  2005-12-12  on final response marked the rb as removed to avoid deleting
103  *              it from the timer handle; timer_allow_del()  (andrei)
104  *  2006-08-11  final_response_handler dns failover support for timeout-ed
105  *              invites (andrei)
106  *  2006-09-28  removed the 480 on fr_inv_timeout reply: on timeout always 
107  *               return a 408
108  *              set the corresponding "faked" failure route sip_msg->msg_flags 
109  *               on timeout or if the branch received a reply (andrei)
110  *  2007-03-15  TMCB_ONSEND callbacks support (andrei)
111  *  2007-05-29  delete on transaction ref_count==0 : removed the delete timer
112  *               (andrei)
113  * 2007-06-01  support for different retransmissions intervals per transaction;
114  *             added maximum inv. and non-inv. transaction life time (andrei)
115  */
116
117 #include "defs.h"
118
119
120
121 #include "config.h"
122 #include "h_table.h"
123 #include "timer.h"
124 #include "../../dprint.h"
125 #include "lock.h"
126 #include "t_stats.h"
127
128 #include "../../hash_func.h"
129 #include "../../dprint.h"
130 #include "../../config.h"
131 #include "../../parser/parser_f.h"
132 #include "../../ut.h"
133 #include "../../timer_ticks.h"
134 #include "../../compiler_opt.h"
135 #include "t_funcs.h"
136 #include "t_reply.h"
137 #include "t_cancel.h"
138 #include "t_hooks.h"
139 #ifdef USE_DNS_FAILOVER
140 #include "t_fwd.h" /* t_send_branch */
141 #include "../../cfg_core.h" /* cfg_get(core, core_cfg, use_dns_failover) */
142 #endif
143 #ifdef USE_DST_BLACKLIST
144 #include "../../dst_blacklist.h"
145 #endif
146
147
148
149 struct msgid_var user_fr_timeout;
150 struct msgid_var user_fr_inv_timeout;
151 #ifdef TM_DIFF_RT_TIMEOUT
152 struct msgid_var user_rt_t1_timeout;
153 struct msgid_var user_rt_t2_timeout;
154 #endif
155 struct msgid_var user_inv_max_lifetime;
156 struct msgid_var user_noninv_max_lifetime;
157
158
159 /* internal use, val should be unsigned or positive
160  *  <= instead of < to get read of gcc warning when 
161  *  sizeof(cell_member)==sizeof(val) (Note that this limits
162  *  maximum value to max. type -1) */
163 #define SIZE_FIT_CHECK(cell_member, val, cfg_name) \
164         if (MAX_UVAR_VALUE(((struct cell*)0)->cell_member) <= (val)){ \
165                 ERR("tm_init_timers: " cfg_name " too big: %lu (%lu ticks) " \
166                                 "- max %lu (%lu ticks) \n", TICKS_TO_MS((unsigned long)(val)),\
167                                 (unsigned long)(val), \
168                                 TICKS_TO_MS(MAX_UVAR_VALUE(((struct cell*)0)->cell_member)), \
169                                 MAX_UVAR_VALUE(((struct cell*)0)->cell_member)); \
170                 goto error; \
171         } 
172
173 /* fix timer values to ticks */
174 int tm_init_timers()
175 {
176         default_tm_cfg.fr_timeout=MS_TO_TICKS(default_tm_cfg.fr_timeout); 
177         default_tm_cfg.fr_inv_timeout=MS_TO_TICKS(default_tm_cfg.fr_inv_timeout);
178         default_tm_cfg.wait_timeout=MS_TO_TICKS(default_tm_cfg.wait_timeout);
179         default_tm_cfg.delete_timeout=MS_TO_TICKS(default_tm_cfg.delete_timeout);
180         default_tm_cfg.rt_t1_timeout=MS_TO_TICKS(default_tm_cfg.rt_t1_timeout);
181         default_tm_cfg.rt_t2_timeout=MS_TO_TICKS(default_tm_cfg.rt_t2_timeout);
182         default_tm_cfg.tm_max_inv_lifetime=MS_TO_TICKS(default_tm_cfg.tm_max_inv_lifetime);
183         default_tm_cfg.tm_max_noninv_lifetime=MS_TO_TICKS(default_tm_cfg.tm_max_noninv_lifetime);
184         /* fix 0 values to 1 tick (minimum possible wait time ) */
185         if (default_tm_cfg.fr_timeout==0) default_tm_cfg.fr_timeout=1;
186         if (default_tm_cfg.fr_inv_timeout==0) default_tm_cfg.fr_inv_timeout=1;
187         if (default_tm_cfg.wait_timeout==0) default_tm_cfg.wait_timeout=1;
188         if (default_tm_cfg.delete_timeout==0) default_tm_cfg.delete_timeout=1;
189         if (default_tm_cfg.rt_t2_timeout==0) default_tm_cfg.rt_t2_timeout=1;
190         if (default_tm_cfg.rt_t1_timeout==0) default_tm_cfg.rt_t1_timeout=1;
191         if (default_tm_cfg.tm_max_inv_lifetime==0) default_tm_cfg.tm_max_inv_lifetime=1;
192         if (default_tm_cfg.tm_max_noninv_lifetime==0) default_tm_cfg.tm_max_noninv_lifetime=1;
193         
194         /* size fit checks */
195         SIZE_FIT_CHECK(fr_timeout, default_tm_cfg.fr_timeout, "fr_timer");
196         SIZE_FIT_CHECK(fr_inv_timeout, default_tm_cfg.fr_inv_timeout, "fr_inv_timer");
197 #ifdef TM_DIFF_RT_TIMEOUT
198         SIZE_FIT_CHECK(rt_t1_timeout, default_tm_cfg.rt_t1_timeout, "retr_timer1");
199         SIZE_FIT_CHECK(rt_t2_timeout, default_tm_cfg.rt_t2_timeout, "retr_timer2");
200 #endif
201         SIZE_FIT_CHECK(end_of_life, default_tm_cfg.tm_max_inv_lifetime, "max_inv_lifetime");
202         SIZE_FIT_CHECK(end_of_life, default_tm_cfg.tm_max_noninv_lifetime, "max_noninv_lifetime");
203         
204         memset(&user_fr_timeout, 0, sizeof(user_fr_timeout));
205         memset(&user_fr_inv_timeout, 0, sizeof(user_fr_inv_timeout));
206 #ifdef TM_DIFF_RT_TIMEOUT
207         memset(&user_rt_t1_timeout, 0, sizeof(user_rt_t1_timeout));
208         memset(&user_rt_t2_timeout, 0, sizeof(user_rt_t2_timeout));
209 #endif
210         memset(&user_inv_max_lifetime, 0, sizeof(user_inv_max_lifetime));
211         memset(&user_noninv_max_lifetime, 0, sizeof(user_noninv_max_lifetime));
212         
213         DBG("tm: tm_init_timers: fr=%d fr_inv=%d wait=%d delete=%d t1=%d t2=%d"
214                         " max_inv_lifetime=%d max_noninv_lifetime=%d\n",
215                         default_tm_cfg.fr_timeout, default_tm_cfg.fr_inv_timeout,
216                         default_tm_cfg.wait_timeout, default_tm_cfg.delete_timeout,
217                         default_tm_cfg.rt_t1_timeout, default_tm_cfg.rt_t2_timeout,
218                         default_tm_cfg.tm_max_inv_lifetime, default_tm_cfg.tm_max_noninv_lifetime);
219         return 0;
220 error:
221         return -1;
222 }
223
224 /* internal macro for timer_fixup()
225  * performs size fit check if the timer name matches
226  */
227 #define IF_IS_TIMER_NAME(cell_member, cfg_name) \
228         if ((name->len == sizeof(cfg_name)-1) && \
229                 (memcmp(name->s, cfg_name, sizeof(cfg_name)-1)==0)) { \
230                         SIZE_FIT_CHECK(cell_member, t, cfg_name); \
231         }
232
233 /* fixup function for the timer values
234  * (called by the configuration framework)
235  */
236 int timer_fixup(void *handle, str *gname, str *name, void **val)
237 {
238         ticks_t t;
239
240         t = MS_TO_TICKS((unsigned int)(long)(*val));
241         /* fix 0 values to 1 tick (minimum possible wait time ) */
242         if (t == 0) t = 1;
243
244         /* size fix checks */
245         IF_IS_TIMER_NAME(fr_timeout, "fr_timer")
246         else IF_IS_TIMER_NAME(fr_inv_timeout, "fr_inv_timer")
247 #ifdef TM_DIFF_RT_TIMEOUT
248         else IF_IS_TIMER_NAME(rt_t1_timeout, "retr_timer1")
249         else IF_IS_TIMER_NAME(rt_t2_timeout, "retr_timer2")
250 #endif
251         else IF_IS_TIMER_NAME(end_of_life, "max_inv_lifetime")
252         else IF_IS_TIMER_NAME(end_of_life, "max_noninv_lifetime")
253
254         *val = (void *)(long)t;
255         return 0;
256
257 error:
258         return -1;
259 }
260
261 /******************** handlers ***************************/
262
263
264 #ifndef TM_DEL_UNREF
265 /* returns number of ticks before retrying the del, or 0 if the del.
266  * was succesfull */
267 inline static ticks_t  delete_cell( struct cell *p_cell, int unlock )
268 {
269         /* there may still be FR/RETR timers, which have been reset
270            (i.e., time_out==TIMER_DELETED) but are stilled linked to
271            timer lists and must be removed from there before the
272            structures are released
273         */
274         unlink_timers( p_cell );
275         /* still in use ... don't delete */
276         if ( IS_REFFED_UNSAFE(p_cell) ) {
277                 if (unlock) UNLOCK_HASH(p_cell->hash_index);
278                 DBG("DEBUG: delete_cell %p: can't delete -- still reffed (%d)\n",
279                                 p_cell, p_cell->ref_count);
280                 /* delay the delete */
281                 /* TODO: change refcnts and delete on refcnt==0 */
282                 return cfg_get(tm, tm_cfg, delete_timeout);
283         } else {
284                 if (unlock) UNLOCK_HASH(p_cell->hash_index);
285 #ifdef EXTRA_DEBUG
286                 DBG("DEBUG: delete transaction %p\n", p_cell );
287 #endif
288                 free_cell( p_cell );
289                 return 0;
290         }
291 }
292 #endif /* TM_DEL_UNREF */
293
294
295
296
297 /* generate a fake reply
298  * it assumes the REPLY_LOCK is already held and returns unlocked */
299 static void fake_reply(struct cell *t, int branch, int code )
300 {
301         branch_bm_t cancel_bitmap;
302         short do_cancel_branch;
303         enum rps reply_status;
304
305         do_cancel_branch = is_invite(t) && prepare_cancel_branch(t, branch, 0);
306         /* mark branch as canceled */
307         t->uac[branch].request.flags|=F_RB_CANCELED;
308         if ( is_local(t) ) {
309                 reply_status=local_reply( t, FAKED_REPLY, branch, 
310                                           code, &cancel_bitmap );
311         } else {
312                 /* rely reply, but don't put on wait, we still need t
313                  * to send the cancels */
314                 reply_status=relay_reply( t, FAKED_REPLY, branch, code,
315                                           &cancel_bitmap, 0 );
316         }
317         /* now when out-of-lock do the cancel I/O */
318         if (do_cancel_branch) cancel_branch(t, branch, 0);
319         /* it's cleaned up on error; if no error occurred and transaction
320            completed regularly, I have to clean-up myself
321         */
322         if (reply_status == RPS_COMPLETED)
323                 put_on_wait(t);
324 }
325
326
327
328 /* return (ticks_t)-1 on error/disable and 0 on success */
329 inline static ticks_t retransmission_handler( struct retr_buf *r_buf )
330 {
331 #ifdef EXTRA_DEBUG
332         if (r_buf->my_T->flags & T_IN_AGONY) {
333                 LOG( L_ERR, "ERROR: transaction %p scheduled for deletion and"
334                         " called from RETR timer (flags %x)\n",
335                         r_buf->my_T, r_buf->my_T->flags );
336                 abort();
337         }       
338 #endif
339         if ( r_buf->activ_type==TYPE_LOCAL_CANCEL 
340                 || r_buf->activ_type==TYPE_REQUEST ) {
341 #ifdef EXTRA_DEBUG
342                         DBG("DEBUG: retransmission_handler : "
343                                 "request resending (t=%p, %.9s ... )\n", 
344                                 r_buf->my_T, r_buf->buffer);
345 #endif
346                         if (SEND_BUFFER( r_buf )==-1) {
347                                 /* disable retr. timers => return -1 */
348                                 fake_reply(r_buf->my_T, r_buf->branch, 503 );
349                                 return (ticks_t)-1;
350                         }
351 #ifdef TMCB_ONSEND
352                         if (unlikely(has_tran_tmcbs(r_buf->my_T, TMCB_REQUEST_SENT))) 
353                                 run_onsend_callbacks(TMCB_REQUEST_SENT, r_buf, 
354                                                                                 0, 0, TMCB_RETR_F);
355 #endif
356         } else {
357 #ifdef EXTRA_DEBUG
358                         DBG("DEBUG: retransmission_handler : "
359                                 "reply resending (t=%p, %.9s ... )\n", 
360                                 r_buf->my_T, r_buf->buffer);
361 #endif
362                         t_retransmit_reply(r_buf->my_T);
363         }
364         
365         return 0;
366 }
367
368
369
370 inline static void final_response_handler(      struct retr_buf* r_buf,
371                                                                                         struct cell* t)
372 {
373         int silent;
374 #ifdef USE_DNS_FAILOVER
375         /*int i; 
376         int added_branches;
377         */
378         int branch_ret;
379         int prev_branch;
380         ticks_t now;
381 #endif
382
383 #       ifdef EXTRA_DEBUG
384         if (t->flags & T_IN_AGONY) 
385         {
386                 LOG( L_ERR, "ERROR: transaction %p scheduled for deletion and"
387                         " called from FR timer (flags %x)\n", t, t->flags);
388                 abort();
389         }
390 #       endif
391         /* FR for local cancels.... */
392         if (r_buf->activ_type==TYPE_LOCAL_CANCEL)
393         {
394 #ifdef TIMER_DEBUG
395                 DBG("DEBUG: final_response_handler: stop retr for Local Cancel\n");
396 #endif
397                 return;
398         }
399         /* FR for replies (negative INVITE replies) */
400         if (r_buf->activ_type>0) {
401 #               ifdef EXTRA_DEBUG
402                 if (t->uas.request->REQ_METHOD!=METHOD_INVITE
403                         || t->uas.status < 200 ) {
404                         LOG(L_CRIT, "BUG: final_response_handler: unknown type reply"
405                                         " buffer\n");
406                         abort();
407                 }
408 #               endif
409                 put_on_wait( t );
410                 return;
411         };
412
413         /* lock reply processing to determine how to proceed reliably */
414         LOCK_REPLIES( t );
415         /* now it can be only a request retransmission buffer;
416            try if you can simply discard the local transaction 
417            state without compellingly removing it from the
418            world */
419         silent=
420                 /* don't go silent if disallowed globally ... */
421                 cfg_get(tm, tm_cfg, noisy_ctimer)==0
422                 /* ... or for this particular transaction */
423                 && has_noisy_ctimer(t) == 0
424                 /* not for UACs */
425                 && !is_local(t)
426                 /* invites only */
427                 && is_invite(t)
428                 /* parallel forking does not allow silent state discarding */
429                 && t->nr_of_outgoings==1
430                 /* on_negativ reply handler not installed -- serial forking 
431                  * could occur otherwise */
432                 && t->on_negative==0
433                 /* the same for FAILURE callbacks */
434                 && !has_tran_tmcbs( t, TMCB_ON_FAILURE_RO|TMCB_ON_FAILURE) 
435                 /* something received -- we will not be silent on error */
436                 && t->uac[r_buf->branch].last_received==0;
437         
438         if (silent) {
439                 UNLOCK_REPLIES(t);
440 #ifdef EXTRA_DEBUG
441                 DBG("DEBUG: final_response_handler: transaction silently dropped (%p)"
442                                 ", branch %d, last_received %d\n",t, r_buf->branch,
443                                  t->uac[r_buf->branch].last_received);
444 #endif
445                 put_on_wait( t );
446                 return;
447         }
448 #ifdef EXTRA_DEBUG
449         DBG("DEBUG: final_response_handler:stop retr. and send CANCEL (%p)\n", t);
450 #endif
451         if ((r_buf->branch < MAX_BRANCHES) && /* r_buf->branch is always >=0 */
452                         (t->uac[r_buf->branch].last_received==0) &&
453                         (t->uac[r_buf->branch].request.buffer!=NULL) /* not a blind UAC */
454         ){
455                 /* no reply received */
456 #ifdef USE_DST_BLACKLIST
457                 if (cfg_get(core, core_cfg, use_dst_blacklist)
458                         && r_buf->my_T
459                         && r_buf->my_T->uas.request
460                         && (r_buf->my_T->uas.request->REQ_METHOD & cfg_get(tm, tm_cfg, tm_blst_methods_add))
461                 )
462                         dst_blacklist_add( BLST_ERR_TIMEOUT, &r_buf->dst,
463                                                 r_buf->my_T->uas.request);
464 #endif
465 #ifdef USE_DNS_FAILOVER
466                 /* if this is an invite, the destination resolves to more ips, and
467                  *  it still hasn't passed more than fr_inv_timeout since we
468                  *  started, add another branch/uac */
469                 if (cfg_get(core, core_cfg, use_dns_failover)){
470                         now=get_ticks_raw();
471                         if ((s_ticks_t)(t->end_of_life-now)>0){
472                                 branch_ret=add_uac_dns_fallback(t, t->uas.request,
473                                                                                                         &t->uac[r_buf->branch], 0);
474                                 prev_branch=-1;
475                                 while((branch_ret>=0) &&(branch_ret!=prev_branch)){
476                                         prev_branch=branch_ret;
477                                         branch_ret=t_send_branch(t, branch_ret, t->uas.request , 
478                                                                                                 0, 0);
479                                 }
480                         }
481                 }
482 #endif
483         }
484         fake_reply(t, r_buf->branch, 408);
485 }
486
487
488
489 /* handles retransmissions and fr timers */
490 /* the following assumption are made (to avoid deleting/re-adding the timer):
491  *  retr_buf->retr_interval < ( 1<<((sizeof(ticks_t)*8-1) )
492  *  if retr_buf->retr_interval==0 => timer disabled
493  *                            ==(ticks_t) -1 => retr. disabled (fr working)
494  *     retr_buf->retr_interval & (1 <<(sizeof(ticks_t)*8-1) => retr. & fr reset
495  *     (we never reset only retr, it's either reset both of them or retr 
496  *      disabled & reset fr). In this case the fr_origin will contain the 
497  *      "time" of the reset and next retr should occur at 
498  *      fr->origin+retr_interval (we also assume that we'll never reset retr
499  *      to a lower value then the current one)
500  */
501 ticks_t retr_buf_handler(ticks_t ticks, struct timer_ln* tl, void *p)
502 {
503         struct retr_buf* rbuf ;
504         ticks_t fr_remainder;
505         ticks_t retr_remainder;
506         ticks_t retr_interval;
507         ticks_t new_retr_interval;
508         struct cell *t;
509
510         rbuf=(struct  retr_buf*)
511                         ((void*)tl-(void*)(&((struct retr_buf*)0)->timer));
512         membar_depends(); /* to be on the safe side */
513         t=rbuf->my_T;
514         
515 #ifdef TIMER_DEBUG
516         DBG("tm: timer retr_buf_handler @%d (%p -> %p -> %p)\n",
517                         ticks, tl, rbuf, t);
518 #endif
519         if (unlikely(rbuf->flags & F_RB_DEL_TIMER)){
520                 /* timer marked for deletion */
521                 rbuf->t_active=0; /* mark it as removed */
522                 /* a membar is not really needed, in the very unlikely case that 
523                  * another process will see old t_active's value and will try to 
524                  * delete the timer again, but since timer_del it's safe in this cases
525                  * it will be a no-op */
526                 return 0;
527         }
528         /* overflow safe check (should work ok for fr_intervals < max ticks_t/2) */
529         if ((s_ticks_t)(rbuf->fr_expire-ticks)<=0){
530                 /* final response */
531                 rbuf->t_active=0; /* mark the timer as removed 
532                                                          (both timers disabled)
533                                                           a little race risk, but
534                                                           nothing bad would happen */
535                 rbuf->flags|=F_RB_TIMEOUT;
536                 /* WARNING:  the next line depends on taking care not to start the 
537                  *           wait timer before finishing with t (if this is not 
538                  *           guaranteed then comment the timer_allow_del() line) */
539                 timer_allow_del(); /* [optional] allow timer_dels, since we're done
540                                                           and there is no race risk */
541                 final_response_handler(rbuf, t);
542                 return 0;
543         }else{
544                 /*  4 possible states running (t1), t2, paused, disabled */
545                         if ((s_ticks_t)(rbuf->retr_expire-ticks)<=0){
546                                 if (rbuf->flags & F_RB_RETR_DISABLED)
547                                         goto disabled;
548                                 /* retr_interval= min (2*ri, rt_t2) , *p==2*ri*/
549                                 /* no branch version: 
550                                         #idef CC_SIGNED_RIGHT_SHIFT
551                                                 ri=  rt_t2+((2*ri-rt_t2) & 
552                                                 ((signed)(2*ri-rt_t2)>>(sizeof(ticks_t)*8-1));
553                                         #else
554                                                 ri=rt_t2+((2*ri-rt_t2)& -(2*ri<rt_t2));
555                                         #endif
556                                 */
557                                 
558                                 /* get the  current interval from timer param. */
559                                 if ((rbuf->flags & F_RB_T2) || 
560                                                 (((ticks_t)(unsigned long)p)>RT_T2_TIMEOUT(rbuf))){
561                                         retr_interval=RT_T2_TIMEOUT(rbuf);
562                                         new_retr_interval=RT_T2_TIMEOUT(rbuf);
563                                 }else{
564                                         retr_interval=(ticks_t)(unsigned long)p;
565                                         new_retr_interval=retr_interval<<1;
566                                 }
567 #ifdef TIMER_DEBUG
568                                 DBG("tm: timer: retr: new interval %d (max %d)\n", 
569                                                 retr_interval, RT_T2_TIMEOUT(rbuf));
570 #endif
571                                 /* we could race with the reply_received code, but the 
572                                  * worst thing that can happen is to delay a reset_to_t2
573                                  * for crt_interval and send an extra retr.*/
574                                 rbuf->retr_expire=ticks+retr_interval;
575                                 /* set new interval to -1 on error, or retr_int. on success */
576                                 retr_remainder=retransmission_handler(rbuf) | retr_interval;
577                                 /* store the next retr. interval inside the timer struct,
578                                  * in the data member */
579                                 tl->data=(void*)(unsigned long)(new_retr_interval);
580                         }else{
581                                 retr_remainder= rbuf->retr_expire-ticks;
582                                 DBG("tm: timer: retr: nothing to do, expire in %d\n", 
583                                                 retr_remainder);
584                         }
585         }
586 /* skip: */
587         /* return minimum of the next retransmission handler and the 
588          * final response (side benefit: it properly cancels timer if ret==0 and
589          *  sleeps for fr_remainder if retr. is canceled [==(ticks_t)-1]) */
590         fr_remainder=rbuf->fr_expire-ticks; /* to be more precise use
591                                                                                         get_ticks_raw() instead of ticks
592                                                                                         (but make sure that 
593                                                                                         crt. ticks < fr_expire */
594 #ifdef TIMER_DEBUG
595         DBG("tm: timer retr_buf_handler @%d (%p ->%p->%p) exiting min (%d, %d)\n",
596                         ticks, tl, rbuf, t, retr_remainder, fr_remainder);
597 #endif
598 #ifdef EXTRA_DEBUG
599         if  (retr_remainder==0 || fr_remainder==0){
600                 BUG("tm: timer retr_buf_handler: 0 remainder => disabling timer!: "
601                                 "retr_remainder=%d, fr_remainder=%d\n", retr_remainder,
602                                 fr_remainder);
603         }
604 #endif
605         if (retr_remainder<fr_remainder)
606                 return retr_remainder;
607         else{
608                 /* hack to switch to the slow timer */
609 #ifdef TM_FAST_RETR_TIMER
610                 tl->flags&=~F_TIMER_FAST;
611 #endif
612                 return fr_remainder;
613         }
614 disabled:
615         return rbuf->fr_expire-ticks;
616 }
617
618
619
620 ticks_t wait_handler(ticks_t ti, struct timer_ln *wait_tl, void* data)
621 {
622         struct cell *p_cell;
623         ticks_t ret;
624
625         p_cell=(struct cell*)data;
626 #ifdef TIMER_DEBUG
627         DBG("DEBUG: WAIT timer hit @%d for %p (timer_lm %p)\n", 
628                         ti, p_cell, wait_tl);
629 #endif
630
631 #ifdef TM_DEL_UNREF
632         /* stop cancel timers if any running */
633         if ( is_invite(p_cell) ) cleanup_localcancel_timers( p_cell );
634         /* remove the cell from the hash table */
635         LOCK_HASH( p_cell->hash_index );
636         remove_from_hash_table_unsafe(  p_cell );
637         UNLOCK_HASH( p_cell->hash_index );
638         p_cell->flags |= T_IN_AGONY;
639         UNREF_FREE(p_cell);
640         ret=0;
641 #else /* TM_DEL_UNREF */
642         if (p_cell->flags & T_IN_AGONY){
643                 /* delayed delete */
644                 /* we call delete now without any locking on hash/ref_count;
645                    we can do that because delete_handler is only entered after
646                    the delete timer was installed from wait_handler, which
647                    removed transaction from hash table and did not destroy it
648                    because some processes were using it; that means that the
649                    processes currently using the transaction can unref and no
650                    new processes can ref -- we can wait until ref_count is
651                    zero safely without locking
652                 */
653                 ret=delete_cell( p_cell, 0 /* don't unlock on return */ );
654         }else {
655                 /* stop cancel timers if any running */
656                 if ( is_invite(p_cell) ) cleanup_localcancel_timers( p_cell );
657                 /* remove the cell from the hash table */
658                 LOCK_HASH( p_cell->hash_index );
659                 remove_from_hash_table_unsafe(  p_cell );
660                 p_cell->flags |= T_IN_AGONY;
661                 /* delete (returns with UNLOCK-ed_HASH) */
662                 ret=delete_cell( p_cell, 1 /* unlock on return */ );
663         }
664 #endif /* TM_DEL_UNREF */
665         return ret;
666 }
667