Commit Graph

93 Commits

Author SHA1 Message Date
Neels Hofmeyr 478e991a78 fix: send RR Release (e.g. after BSSMAP Clear Cmd)
After commit [1], the code makes sure to disassociate lchan and conn before
invoking the lchan release. However, we only send RR Release if a conn is
present, which clearly is nonsense after [1].

[1] commit 8b818a01b0
    "subscr conn: properly forget lchan before release"
    Change-Id: I4fd582b41ba4599af704d670af83651d2450b1db

Manage sending of RR Release via a flag, set during invoking lchan release.

Add do_rr_release arg to lchan_release(), gscon_release_lchans(). In
lchan_fsm.c, send RR Release only if do_rr_release was passed true; do not care
whether a conn is still associated (because it won't ever be since [1]).

That way we can intelligently decide what release process makes sense (whether
the lchan terminates the subscriber connection or whether the connection goes
on at another lchan), and still disassociate lchan and conn early.

BTW, this problem wasn't caught by the stock OsmoBSC TTCN3 tests, because the
f_expect_chan_rel() don't care whether an RR Release happens or not. This is
being fixed by Ibc64058f1e214bea585f4e8dcb66f3df8ead3845.

So far this patch should fix BSC_Tests_LCLS.TC_lcls_connect_clear.

Related: OS#3413
Change-Id: I666b3b4f45706d898d664d380bd0fd2b018be358
2018-11-14 16:16:30 +00:00
Philipp Maier 89d72d8055 gsm_data: make cgi_for_msc available for other modules
The function cgi_for_msc() provides an easy way to get a cell global id
for an msc/bts combination. This function is currently statically
defined in gsm_08_08.c. Lets move it to gsm_data.c and make it publicly
available.

Change-Id: I301fac6e83a429ae59b5c586aa283ad7ba54053d
Related: OS#3645
2018-11-09 11:01:19 +00:00
Oliver Smith 8d8d710a28 vty: add 'show rejected-bts'
Print IDs and IPs of recently rejected BTS devices. Example output:

OsmoBSC> show rejected-bts
Date                Site ID BTS ID IP
------------------- ------- ------ ---------------
2018-10-25 09:36:28    1234      0    192.168.1.37

Related: OS#2841
Change-Id: Iba3bfe8fc9432b7ae8f819df8bd71b35b3ec507e
2018-10-30 16:25:29 +01:00
Philipp Maier c9a4f697d3 codec_pref: handle S0-S15 in ASSIGNMENT REQUEST
Opposed to all other codecs that are common in GSM, AMR requires a codec
configuration that is expressed by a bitmask (S0 to S15) in the speech
codec list in the ASSIGNMENT REQUEST. Also the BSC acknowledges those
configuration in the ASSIGNMENT COMPLETE message.

At the moment osmo-bsc ignores all incoming configuration bits. The bits
in the ASSIGNMENT COMPLETE speech codec (choosen) field are hardcoded.

- Store the configuration bits while parsing the ASSIGNMENT COMPLETE
- Create an intersection with the configuration that is actually
  supported by the BSS
- Return the resulting (chosen) configuration bits with the assignment
  complete message.
- Use the (highest of the) agreed codec rates in RSL channel activation.

Change-Id: I2d8ded51b3eb4c003fe2da6f2d6f48d001b73737
Related: OS#3529
2018-10-05 07:58:22 +00:00
Philipp Maier ef121b2408 gsm_data: remove unused struct member chan_mode
Remove unused gsm_subscriber_connection.user_plane.chan_mode.
There is only one VTY command that displays it along other
parameters, but it is used no where else. Lets remove it.

It was forgotten to be removed in:

commit 31f525e756
Date   Mon May 14 18:14:15 2018 +0200
"large refactoring: use FSMs for lchans; add inter-BSC HO"
change-id I82e3f918295daa83274a4cf803f046979f284366

Change-Id: I10049c14ea206a4daafbdad01634d57c72a79d7c
2018-09-17 14:55:13 +02:00
Philipp Maier 7f52bdadbd gsm_data: remove unused struct member full_rate.
Remove unused member gsm_subscriber_connection.user_plane.full_rate.

It was forgotten to be removed in:

commit 31f525e756
Date   Mon May 14 18:14:15 2018 +0200
"large refactoring: use FSMs for lchans; add inter-BSC HO"
change-id I82e3f918295daa83274a4cf803f046979f284366

Change-Id: I3a14efe0039ff4690e27e3b083eb23c1b2a616c3
2018-09-17 14:54:40 +02:00
Harald Welte 24286f37b7 Introduce gsm48_lchan2chan_desc_as_configured()
gsm48_lchan2chan_desc_as_configured() is similar to gsm48_lchan2chan_desc(),
but uses the *configured* channel combination, rather than the currently
active one.

Change-Id: Id4043218fb770e8420f19a4ef9428680ecdfd286
Related: OS#3532
2018-09-09 17:23:56 +02:00
Harald Welte 251bec1e5d gsm48_lchan2chan_desc() belongs to gsm_data.h
The function is defined in gsm_data.c, so it should be declared
in gsm_data.h and not in gsm_04_08_rr.h

Change-Id: I5200063fb43c857a984ea8e41a8485d796e49cde
2018-09-09 17:23:56 +02:00
Neels Hofmeyr 193c1e3ab0 lchan_fsm: safer 'concluded' flag
The flag lchan->activate.concluded prevents entering the
lchan_on_fully_established()/lchan_on_activation_failure() more than once. So
far it was checked by callers, instead place in the functions themselves.

There is a potential functional change here, since during lchan_fail(), the
concluded flag was set only after entering lchan_on_activation_failure(). Now
it is already set at the start and prevents multiple re-entry beyond doubt.

This patch is not a result of an actual observed faulty behavior, just from
reading the code and seeing the slight loophole.

Change-Id: I0c906438b05442d66255203eb816453b7193a6d8
2018-08-29 02:02:10 +02:00
Pau Espin 9862bcb5cd Fix heap-use-after-free due to OML link destruction
ipaccess_drop_oml was being called inside an osmo_fd cb context, were
-EBADF must be returned if the structure holding the osmo_fd is freed.
In the middle of the path (see OS#3495 for path tree) it goes through a
signal dispatch, so it's impossible to make sure we return some value to
the osmo_fd cb. As a result, it is required to defer dropping the OML
Link from current code path and do it through a timer.

Fixes following ASan report:
20180822124927913  <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed
20180822124927913  <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links.
20180822124927913  <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link.
...
=================================================================
==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78
READ of size 8 at 0x62e000060a68 thread T0
    #0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371
    #1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391
    #2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217
    #3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257
    #4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922
    #5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9)

Fixes: OS#3495
Change-Id: I7c794c763481c28e8c35dc9b11d27969e16feb3c
2018-08-23 16:47:30 +02:00
Neels Hofmeyr 6d568ed7ff cosmetic: constify gsm_bts_num() net arg
Change-Id: I9a078ffb781ee55c0ca114fa0d752c1b53067419
2018-07-28 12:18:23 +02:00
Neels Hofmeyr d5df9a1d0d lchan_fsm: add in_release_handler flag
If a release event is being handled, ignore other ricocheting release events
until that release handling has concluded.

For example, if an lchan is regularly released, it signals the lchan RTP FSM to
release, which then calls back to say "RTP is released" on termination -- this
should not trigger other state changes than the initial release intends.

Change-Id: Iec41e006b6ab9d0f618d36925341f9536353e5d8
2018-07-28 12:18:23 +02:00
Neels Hofmeyr ac85b34476 lchan_fsm: split off lchan_rtp_fsm, establish RTP a bit earlier
Change-Id: Id7a4407d9b63be05ce63f5f2768b7d7e3d5c86fb
2018-07-28 12:18:23 +02:00
Neels Hofmeyr dbb38d532b fix BSC_CTR_ASSIGNMENT doc strings
Change-Id: I9de0c16a14edd8bf4f02b7781ccfd211e0a79463
2018-07-28 12:18:23 +02:00
Neels Hofmeyr bcdbfb7406 fix nanobts: timeslot FSM: use flags to remember OML,RSL status
Before this patch, the timeslot FSM receives OML and RSL ready events.
Afterwards, it relies on examining the RSL and OML status to match the received
events. This doesn't work for the ip.access nanobts, which fails to change the
CHANNEL OM's operational status even though it has sent an Opstart ACK.  We
receive OML CHANNEL Opstart ACK, but the mo's state left at OP_STATE=Disabled.
We apparently cannot rely on the gsm_abis_mo state as assumed before this
patch, since changing the state depends on each BTS vendor's OML
implementation.

Also, implementation wise, it is better to not include assumptions on RSL and
OML implementations in the timeslot FSM. Simply receive the OML and RSL ready
events and remember that they arrived in dedicated flags.

Remove the no longer needed oml_is_ts_ready() callback from struct
gsm_bts_model added in:

  commit 91aa68f762
  "dyn TS: init only when both RSL and the Channel OM are established"
  I99f29d2ba079f6f4b77f0af12d9784588d2f56b3

This keeps osmo-bts operational while fixing ip.access nanobts, where the
CHANNEL OM's state prevented the timeslot FSM from entering operation.

Change-Id: I4843d03b3237cdcca0ad2041ef6895ff253d8419
2018-07-28 12:18:23 +02:00
Neels Hofmeyr 31f525e756 large refactoring: use FSMs for lchans; add inter-BSC HO
Add FSMs:

- timeslot_fsm: handle dynamic timeslots and OML+RSL availability.
- lchan_fsm: handle an individual lchan activation, RTP stream and release,
  signal the appropriate calling FSMs on success, failure, release.
- mgw_endpoint_fsm: handle one entire endpoint with several CI.
- assignment_fsm: BSSMAP Assignment Request.
- handover_fsm: all of intra, inter-MO and inter-MT handover.

Above FSMs absorb large parts of the gscon FSM. The gscon FSM was surpassing
the maximum amount events (32), and it is more logical to treat assignment,
handover and MGW procedures in separate FSMs.

- Add logging macros for each FSM type:
  - LOG_TS()
  - LOG_LCHAN()
  - LOG_MGWEP(), LOG_CI()
  - LOG_ASSIGNMENT()
  - LOG_HO()
  These log with the osmo_fsm_inst where present.
  New style decision: logging without a final newline char is awkward,
  especially for gsmtap logging and when other logs interleave LOGPC() calls;
  we have various cases where the final \n goes missing, and also this invokes
  the log category checking N times instead of once.
  So I decided to make these macros *always* append a newline, but only if
  there is no final newline yet. I hope that the compiler optimizes the
  strlen() of the constant format strings away. Thus I can log with or without
  typing "\n" and always get an \n termination anyway.

General:

- replace osmo_timers, state enums and program-wide osmo_signal_dispatch()
  with dedicated FSM timeouts, states and events.

- introduce a common way to handle Tnnn timers: gsm_timers.h/.c: struct T_def.
  These can be used (with some macro magic) to define a state's timeout once,
  and not make mistakes for each osmo_fsm_inst_state_chg().

Details:

bsc_subscr_conn_fsm.c:

- move most states of this FSM to lchan_fsm, assignment_fsm, handover_fsm and
  mgw_endpoint_fsm.

- There is exactly one state for an ongoing Assignment, with all details
  handled in conn->assignment.fi. The state relies on the assignment_fsm's
  timeout.

- There is one state for an ongoing Handover; except for an incoming Handover
  from a remote BSS, the gscon remains in ST_INIT until the new lchan and conn
  are both established.

- move bssmap_add_lcls_status() to osmo_bsc_lcls.c

abis_rsl.c:

- move all dynamic timeslot logic away into timeslot_fsm. Only keep plain send/receive functions in
  abis_rsl.c

- reduce some rsl functions to merely send a message, rename to "_tx_".
  - rsl_ipacc_mdcx(): add '_tx_' in the name; move parts that change the lchan state out into the
    lchan_fsm, the lchan->abis_ip.* are now set there prior to invoking this function.

- move all timers and error/release handling away into various FSMs.

- tweak ipa_smod_s_for_lchan() and ipa_rtp_pt_for_lchan() to not require an
  lchan passed, but just mode,type that they require. Rename to
  ipacc_speech_mode*() and ipacc_payload_type().

- add rsl_forward_layer3_info, used for inter-BSC HO MO, to just send the RR
  message received during BSSMAP Handover Command.

- move various logging to LOG_LCHAN() in order to log with the lchan FSM instance.
  One drawback is that the lchan FSM is limited to one logging category, i.e. this moves some logging
  from DRR to DRSL. It might actually make sense to combine those categories.

- lose LOGP...LOGPC logging cascades: they are bad for gsmtap logging and for performance.

- handle_classmark_chg(): change logging, move cm2 len check out of the cm3 condition (I hope that's
  correct).

- gsm48_send_ho_cmd(): split off gsm48_make_ho_cmd() which doesn't send right away, so that during
  inter-bsc HO we can make an RR Handover Command to send via the MSC to the remote BSS.

assignment_fsm.c:

- the Chan Mode Modify in case of re-using the same lchan is not implemented
  yet, because this was also missing in the previous implementation (OS#3357).

osmo_bsc_api.c:

- simplify bsc_mr_config() and move to lchan_fsm.c, the only caller; rename to
  lchan_mr_config(). (bsc_mr_config() used to copy the values to mr_bts_lv
  twice, once by member assignment and then again with a memcpy.)

- During handover, we used to copy the MR config from the old lchan. Since we
  may handover between FR and HR, rather set the MR Config anew every time, so
  that FR rates are always available on FR lchans, and never on HR lchans.

Depends: I03ee7ce840ecfa0b6a33358e7385528aabd4873f (libosmocore),
         I1f2918418c38918c5ac70acaa51a47adfca12b5e (libosmocore)
Change-Id: I82e3f918295daa83274a4cf803f046979f284366
2018-07-28 12:18:23 +02:00
Neels Hofmeyr 596c402835 add gsm_timers, for Tnnn definitions usable by FSMs
Change-Id: If212fcd042051b6fa53484254223614c5b93a9c6
2018-07-28 12:18:23 +02:00
Neels Hofmeyr 149160f9f1 fix / clarify rsl dtap cache
In certain situations like handover or assignment, DTAP must not go out via RSL
directly but is cached to be submitted later. Make sure that all RSL DTAP
sending adheres to this:

gscon_submit_rsl_dtap() is the new "public" API to request an RSL DTAP to be
sent. Depending on the gscon's state, this ends up in the cache or is sent
directly. When caching, there is no way to tell whether sending will succeed or
not, so semantically it does not make sense to even return a result code. Just
return void. Change all "public" callers to gscon_submit_rsl_dtap().

Merge gsm0808_submit_dtap() and submit_dtap() guts to gsm0808_send_rsl_dtap(),
static in bsc_subscr_conn_fsm.c: directly send DTAP, assume a conn->lchan to be
present, or otherwise trigger a BSSMAP Clear Request.

The static submit_dtap() becomes a thin convenience wrapper.

Move ho_dtap_cache* functions to bsc_subscr_conn_fsm.c and rename to
gscon_dtap_cache_* -- they are not only for handover, also for assignment.

Function gsm0808_submit_dtap() m
Introduce function gscon_submit_rsl_dtap()

Change-Id: I6ffd7aa641c8905292c769400048c96aa0949585
2018-07-28 12:18:23 +02:00
Neels Hofmeyr 19bed23065 inter-BSC HO: add neighbor_ident API to manage neighbor-BSS-cells
Depends: Ia71ba742108b5ff020997bfb612ad5eb30d04fcd (libosmocore)
Change-Id: I0153d7069817fba9146ddc11214de2757d7d37bf
2018-07-28 12:18:23 +02:00
Neels Hofmeyr 0c1ac9f010 make T10 configurable like the rest of them
Change-Id: I112c0db17d355d57eb08bc67121ccf49fbf53943
2018-06-08 16:16:42 +00:00
Neels Hofmeyr fc622c7241 drop dead code: conn->T10, handled by gscon instead
Change-Id: Ief20cb0f46dd93f46dd765dca307724dc2b3487c
2018-06-08 16:16:42 +00:00
Neels Hofmeyr 0abe84e679 HO: introduce T7, T8, T101 timers
Will be used in upcoming inter-BSC handover.

Change-Id: If9ecccc793426d214019f299b19d6ffa5a186546
2018-06-08 16:16:42 +00:00
Neels Hofmeyr c19581f268 remove struct bsc_api
struct bsc_api was used to provide an abstract API for both osmo-bsc and
osmo-msc, between BSC and MSC. That's no longer needed, so get rid of it, to
prevent code turbulences it creates for no reason.

Change-Id: I3fd5888c63a0b4f95520a498320aa105a6d60579
2018-06-07 19:09:06 +02:00
Neels Hofmeyr 958f259f95 dissolve libbsc: move all to src/osmo-bsc, link .o files
Move all of libbsc/ into osmo-bsc/, and separate/move some implementations to
allow linking from utils/* and ipaccess/* without pulling in unccessary
dependencies.

Some utilities use gsm_network and gsm_bts structs, which already include data
structures for fairly advanced uses. Move initialization that only osmo-bsc
needs into new bsc_network_init() and bsc_bts_alloc_register() functions, so
that the leaner tools can use the old gsm_* versions without the need to link
everything (e.g. handover and lchan alloc code).

In some instances, there need to be stubs if to cut off linking "just before
the RSL level" and prevent dependencies from creeping in.
- abis_rsl_rcvmsg(): the only program currently interpreting RSL messages is
  osmo-bsc, the utils are merely concerned with OML, if at all.
- paging_flush_bts(): ip.access nanobts models call this when the RSL link is
  dropped. Only osmo-bsc actually needs to do anything there.
- on_gsm_ts_init(): the mechanism to trigger timeslot initialization is related
  to OML, while this action to take on init would pull in RSL dependencies.
utils/ and ipaccess/ each have a stubs.c file to implement these stubs. Tests
implement stubs inline where required.

From src/utils/, src/ipaccess/ and tests/*/, link in .o files from osmo-bsc/.
In order for this to work, the osmo-bsc subdir must be built before the other
source trees. (An alternative would be to include the .c files as sources, but
that would re-compile them in every source tree. Not a large burden really, but
unless linking .o files gives problems, let's have the quicker build.)

Minor obvious cleanups creep in with this patch, I will not bother to name them
individually now unless code review asks me to.

Rationale:

1) libbsc has been separate to use it for osmo-nitb and osmo-bsc in the old
openbsc.git. This is no longer required, and spreading over libbsc and osmo-bsc
is distracting.

2) Recently, ridiculous linking requirements have made adding new functions
cumbersome, because libbsc has started depending on osmo-bsc/*.c
implementations: on gscon FSM and bssap functions. For example, neither
bs11_config nor ipaccess-config nor bts_test need handover_cfg or BSSMAP
message composition. It makes no sense to link the entire osmo-bsc to it, nor
do we want to keep adding stubs to each linking realm.

Change-Id: I36a586726f5818121abe54d25654819fc451d3bf
2018-06-07 19:09:06 +02:00
Harald Welte c997ceb750 Add initial 3GPP LCLS support to OsmoBSC
This code contains the following code:
* receive/parse/interpret LCLS specific BSSMAP IEs and PDUs
* osmo_fsm handling the various states and their transitions
* call leg correlation (finding the other subscr_conn with same GCR)
* communication between the two call-leg LCLS FSMs
* detection of supported / unsupported LCLS configurations
* display of GCR / LCLS information in "show conns"
* switch the media streams locally using MDCX to the MGW

Closes: OS#1602
Change-Id: I614fade62834def5cafc94c4d2578cd747a3f9f7
2018-06-02 20:56:17 +02:00
Harald Welte 1876c3108c move 'extern struct gsm_network *bsc_gsmnet" to header file
It's not a good idea to keep extern declarations copied over
half a dozen C files.  Let's move it to a header.

Change-Id: I6f643f1393ba0955d9c0cf1cf78d5c604e7b9451
2018-05-27 20:17:06 +02:00
Neels Hofmeyr 163f631f08 cosmetic: define TCH_F_PDCH_PENDING_MASK as actual bitwise or
Change-Id: I5266d6e1ea0ea89c66fa481136c31e2f84bcb313
2018-05-23 13:32:02 +02:00
Neels Hofmeyr 8da2233426 bsc_api.c: actually log with context
bsc_api.c notoriously lacks log context. Provide gsm_lchan_name() and/or
bsc_subscr_name() in roughly a million instances, using new LOGPLCHAN macro.

Add LOGPLCHAN() to gsm_data.h, to encourage use of it in other .c files.

Change-Id: If469defcc6fe8950dac5df61db3f39d297893318
2018-05-23 07:27:39 +00:00
Stefan Sperling 7926d98509 add counter for connection attempts from BTS with unknown unit id
Add a global counter to the BSC which shows the number of failed
connections attempts due to a unit_id mismatch between the BSC
and the BTS.

Change-Id: I58866aff36a1c8463bf84b4392a5124ffeaa32ea
Related: OS#3245
2018-05-22 10:11:34 +02:00
Stefan Sperling 71d524c059 show all global counters of osmo-bsc in vty
The 'show statistics' VTY command was not showing all counters
maintained by osmo-bsc. Instead of printing just two counters
related to paging, print all available counters in a generic way.

Adjust descriptions of some counters for nicer display.

After startup (all counters are zero) is now looks like this:

OsmoBSC# show statistics
       handover:attempted:          0 Received handover attempts.
      handover:no_channel:          0 Sent no channel available responses.
         handover:timeout:          0 Timeouts of timer T3103.
       handover:completed:          0 Received handover completed.
          handover:failed:          0 Received HO FAIL messages.
         paging:attempted:          0 Paging attempts for a subscriber.
          paging:detached:          0 Paging request send failures because no responsible BTS was found.
         paging:responded:          0 Paging attempts with successful response.
OsmoBSC#

Change-Id: I58ae04e1960774d760e3ebb54a4f307c9f753655
Related: OS#3245
2018-05-18 11:38:24 +00:00
Neels Hofmeyr 91aa68f762 dyn TS: init only when both RSL and the Channel OM are established
Recent Icf6e25ff068e8a2600562d52726ead65e864ec02 changed the dyn_ts_init() hook
from bootstrap_rsl() to the Channel OPSTART ACK, but this is not sufficient.
Now RBS2k never calls dyn_ts_init(), and we may need to wait for RSL:

Dyn TS should actually be initialized only when *both* OML opstart and RSL link
are established. To that end, introduce a generalized API to query OML and RSL
status and to trigger a timeslot init at the appropriate time.

Add gsm_ts_check_init() to be called both when RSL and OML opstart are
established: trigger gsm_ts_init() only when both are given.

Add gsm_bts_trx_ts->initialized flag to mark whether initialization has already
taken place. Add gsm_bts_mark_all_ts_uninitialized() to conveniently clear this
flag for all TS in a BTS.

Add gsm_bts_model.oml_is_ts_ready() callback so that each BTS implementation
can return the OML status of a timeslot in its own OML implementation.
Actually, currently all BTS models that need this init mechanism store the TS'
OML status in ts->mo.nm_state. While we would in practice correctly init dyn TS
by just looking at ts->mo.nm_state, semantically, the decision whether the TS
is ready is up to the BTS models' specific OML implementations.

From bootstrap_rsl(), call gsm_ts_check_init(), in case the TS OML Opstart has
happened before RSL is established -- applies to all BTS models.

For all BTS models:
- call gsm_{bts,trx}_mark_all_ts_uninitialized() when OM is torn down, to make
  sure the TS init mechanism will work a second time.

For all BTS models supporting dyn TS, i.e. osmo-bts, nanobts and RBS2k:
- implement oml_is_ts_ready().
- call gsm_ts_check_init() when a Channel OM is taken into operation.

Any BTS models that don't set oml_is_ts_ready() will see a ts init as soon as
RSL is bootstrapped (incidentally, the old dyn TS behavior before recent
Icf6e25ff068e8a2600562d52726ead65e864ec02).

This firstly fixes dyn TS for RBS2k by re-adding the initial switch to PDCH,
and furthermore does so only after both OML TS opstart and RSL are through.

This fixes the ttcn3-bsc-tests around dyn TS, since for the osmo-bts-virtual,
the RSL is established only after OML opstart on the TS, which was broken by
Icf6e25ff068e8a2600562d52726ead65e864ec02.

Nokia Site and Siemens BS11 practically do not require this init mechanism,
since all that happens there so far is dyn TS init, and these BTS models do not
support dyn TS of any kind. A future patch may add oml_is_ts_ready().

Related: OS#3205
Change-Id: I99f29d2ba079f6f4b77f0af12d9784588d2f56b3
2018-05-10 04:53:53 +02:00
Pau Espin 5198342fb5 gsm_data_shared.h: Remove unused enum gsm_paging_event
Change-Id: I13f30177a4840d68e3d374861fb9c76e9842be2e
2018-04-23 16:57:07 +02:00
Harald Welte ead291aaf2 bssmap: State correct speech codec in ASSIGNMENT COMPLETE
Correctly compute the TS 48.008 "speech mode" (codec) for AMR on TCH/F.

There are way too many different ways how to express a given voice
codec.  There are two different schemes in TS 48.008 alone, plus one
on TS 48.058 and one in 04.08 / 44.018.  Let's avoid unneeded
conversion (that we might get wrong) and avoid storing information in
a sub-struct of the lchan if we can simply derive it from the lchan
at the time we need it.

Also, move BSSAP related encoding/conversion functions closer to the
user (osmo_bsc_bssap), rather than in libbsc.

Without this patch, TCH/F with AMR was erroneously reported as TCH/H
with AMR in the BSSMAP ASSIGNMENT COMPLETE.  After this patch, it's
reported correctly.

Change-Id: I6feebfae77fdc93a7ce333a25dd9b9267c5a4a2e
Related: OS#3094
Related: OS#3095
Related: OS#3096
2018-03-22 15:15:12 +00:00
Philipp Maier 79745fc0cb cosmetic: fix typo
Change-Id: I36ed82dcb6010b331fe247a60f373d8e2e8a4bfc
Related: OS#2823
2018-03-22 12:55:41 +00:00
Harald Welte 3561bd4897 introduce an osmo_fsm for gsm_subscriber_connection
In the current implementation of osmo-bsc, the subscriber connection is
not handled (very) statefully. However, there is some state keeping in the
code that handles the mgcp connection, but there are still to much loose ends
which allow odd situations to happen, which then lead severe error situations
(see also closes tags at the end) This commit adds a number of improvements
to fix those problems.

- Use an osmo-fsm to control the gsm_subscriber_connection state and
  make sure that certain operations can only take place at certain states
  (e.g let connection oriented SCCP traffic only pass when an SCCP connection
  actually exists.

  Remove the old osmo_bsc_mgcp.c code. Use the recently developed MGCP client
  FSM to handle the MGCP connections.

  Also make sure that stuff that already works does not break. This in
  particular refers to the internal handover capability and the respective
  unit-tests.

  See also OS#2823, OS#2768 and OS#2898

- Fix logic to permit assignment to a signalling channel. (OS#2762)

- Introduce T993210 to release lchan + subscr_conn if MSC fails to respond

  The GSM specs don't have an explicit timer for this, so let's introdcue
  a custom timer (hence starting with 99).

  This timeout catches the following situation:
  * we send a SCCP CR with COMPL_L3_INFO from the MS to the MSC,
  * the MSC doesn't respond (e.g. SCCP routing failure, program down, ...)

  The MS is supposed to timeout with T3210, 3220 or 3230.  But the BSC
  shouldn't trust the MS but have some timer on its own.

  SCCP would have a timer T(conn est), but that one is specified to be
  1-2min and hence rather long.

  See also: OS#2775

- Terminate bsc_subscr_conn_fsm on SCCP N-DISC.ind from MSC

  If the MSC is disconnecting the SCCP channel, we must terminate the FSM
  which in turn will release all lchan's and other state.

  This makes TC_chan_rel_hard_rlsd pass, see also OS#2731

  As a side-effect, this fixes TC_chan_act_ack_est_ind_refused(),
  where the MSC is answering with CREF to our CR/COMPL_L3.

- Release subscriber connection on RLL RELEASE IND of SAPI0 on main DCCH

  The subscriber connection isn't really useful for anything after the
  SAPI0 main signalling link has been released.  We could try to
  re-establish, but our best option is probably simply releasing the
  subscriber_conn and anything related to it.

  This will make TC_chan_rel_rll_rel_ind pass, see also OS#2730

This commit has been tested using the BSC_Tests TTCN3 testsuit and the
following tests were passed:

TC_chan_act_noreply
TC_chan_act_ack_noest
TC_chan_act_ack_est_ind_noreply
TC_chan_act_ack_est_ind_refused
TC_chan_act_nack
TC_chan_exhaustion
TC_ctrl
TC_chan_rel_conn_fail
TC_chan_rel_hard_clear
TC_chan_rel_hard_rlsd
TC_chan_rel_a_reset
TC_rll_est_ind_inact_lchan
TC_rll_est_ind_inval_sapi1
TC_rll_est_ind_inval_sapi3
TC_rll_est_ind_inval_sacch
TC_assignment_cic_only
TC_assignment_csd
TC_assignment_ctm
TC_assignment_fr_a5_0
TC_assignment_fr_a5_1_codec_missing
TC_assignment_fr_a5_1
TC_assignment_fr_a5_3
TC_assignment_fr_a5_4
TC_paging_imsi_nochan
TC_paging_tmsi_nochan
TC_paging_tmsi_any
TC_paging_tmsi_sdcch
TC_paging_tmsi_tch_f
TC_paging_tmsi_tch_hf
TC_paging_imsi_nochan_cgi
TC_paging_imsi_nochan_lac_ci
TC_paging_imsi_nochan_ci
TC_paging_imsi_nochan_lai
TC_paging_imsi_nochan_lac
TC_paging_imsi_nochan_all
TC_paging_imsi_nochan_plmn_lac_rnc
TC_paging_imsi_nochan_rnc
TC_paging_imsi_nochan_lac_rnc
TC_paging_imsi_nochan_lacs
TC_paging_imsi_nochan_lacs_empty
TC_paging_imsi_a_reset
TC_paging_counter
TC_rsl_drop_counter
TC_classmark
TC_unsol_ass_fail
TC_unsol_ass_compl
TC_unsol_ho_fail
TC_err_82_short_msg
TC_ho_int

Authors:
Harald Welte <laforge@gnumonks.org>
Philipp Maier <pmaier@sysmocom.de>
Neels Hofmeyr <neels@hofmeyr.de>

Closes: OS#2730
Closes: OS#2731
Closes: OS#2762
Closes: OS#2768
Closes: OS#2775
Closes: OS#2823
Closes: OS#2898
Closes: OS#2936
Change-Id: I68286d26e2014048b054f39ef29c35fef420cc97
2018-03-16 18:49:47 +00:00
Philipp Maier 8c498fc26b gsm_data: use feature list from libosmocore
In order to avoid code duplication the feature list (bit masks) and
the desciptive value strings as well as the function to set and get
the feature bits have been moved to libosmocore.

- use feature list functionality provided by libosmocore

Depends: libosmocore Change-Id Id0c35aef11aa49aa40abe7deef1f9dbd12210776
Change-Id: I3e80517539cc5d0e5d8189d434a5e3cc0fdea1a0
2018-03-12 10:18:05 +00:00
Neels Hofmeyr f93970b167 implement support for 3-digit MNC with leading zeros
Add 3-digit flags and use the new RAI and LAI API from libosmocore throughout
the code base to be able to handle an MNC < 100 that has three digits (leading
zeros).

The changes to abis_test and gsm0408_test show that this code now handles
3-digit MNC correctly, by not dropping the leading zero as 0xf in the encoded
PLMN.

Re-implement CTRL commands 'mcc', 'mnc' and 'mcc-mnc-apply' to preserve the
presence of the third digit of the MNC. Always reply with all leading zeros.
Adjust the expected results in ctrl_test_runner.py, to show that it works.

In VTY and CTRL, the parsing of MCC and MNC is inherently made stricter by use
of osmo_{mcc,mnc}_from_str() -- they will no longer allow surplus characters
and detect errno returned by strtol() (in contrast to atoi()).

Depends: Id2240f7f518494c9df6c8bda52c0d5092f90f221 (libosmocore),
	 Ib7176b1d65a03b76f41f94bc9d3293a8a07d24c6 (libosmocore),
	 I020a4f11791c61742a3d795f782805f7b7e8733e (libosmocore)
Change-Id: I8e722103344186fde118b26d8353db95a4581daa
2018-03-07 15:34:48 +00:00
Neels Hofmeyr 4d358c00e1 gsm48_ra_id_by_bts(): struct gsm48_ra_id* instead of buf
Move from using deprecated gsm48_construct_ra(), which uses a buf, to
gsm48_encode_ra(), which uses a gsm48_ra_id argument. Pass struct gsm48_ra_id
around instead of a buf.

struct gsm48_ra_id is the "encoded" representation of the bytes in a typical
MCC-MNC-LAC-RAC (04.08 Routing Area Id IE, 3GPP TS 24.008 § 10.5.5.15). Using
the struct spares using magic numbers for byte offsets.

In the process, fix a sanitizer warning for unaligned access by using memcpy()
instead of pointer assignment:

  osmo-bsc/src/libbsc/abis_nm.c:2857:27: runtime error: store to misaligned address 0x7ffe8e0d6695 for type 'uint16_t', which requires 2 byte alignment

Note that (besides removing a now unnecessary cast) the gsm0408_test and
abis_test tests of RAI / CGI encoding remain stable, which indicates that the
new code is still correct.

Change-Id: I0d3908fb8ca1e2e669d257b5d59b40675fa85d06
2018-03-05 05:35:54 +01:00
Stefan Sperling 6442e4327b Add support for Access Control Class ramping.
Access Control Class (ACC) ramping is used to slowly make the cell
available to an increasing number of MS. This avoids overload at
startup time in cases where a lot of MS would discover the new
cell and try to connect to it all at once.

Ramping behaviour can be configured with new VTY commands:

  [no] access-control-class-ramping
  access-control-class-ramping-step-interval (<30-600>|dynamic)
  access-control-class-ramping-step-size (<1-10>)

(The minimum and maximum values for these parameters are hard-coded,
but could be changed if they are found to be inadequate.)

The VTY command 'show bts' has been extended to display the
current ACC ramping configuration.

By default, ACC ramping is disabled.

When enabled, the default behaviour is to enable one ACC per
ramping step with a 'dynamic' step interval. This means the
ramping interval (time between steps) is scaled to the channel
load average of the BTS, i.e. the number of used vs. available
channels measured over a certain amount of time.

Below is an example of debug log output with ACC ramping enabled,
while many 'mobile' programs are concurrently trying to connect
to the network via an osmo-bts-virtual BTS. Initially, all ACCs
are barred, and then only one class is allowed. Then the current
BTS channel load average is consulted for scheduling the next
ramping step. While the channel load average is low, ramping
proceeds faster, and while it is is high, ramping proceeds slower:

(bts=0) ACC RAMP: barring Access Control Class 0
(bts=0) ACC RAMP: barring Access Control Class 1
(bts=0) ACC RAMP: barring Access Control Class 2
(bts=0) ACC RAMP: barring Access Control Class 3
(bts=0) ACC RAMP: barring Access Control Class 4
(bts=0) ACC RAMP: barring Access Control Class 5
(bts=0) ACC RAMP: barring Access Control Class 6
(bts=0) ACC RAMP: barring Access Control Class 7
(bts=0) ACC RAMP: barring Access Control Class 8
(bts=0) ACC RAMP: barring Access Control Class 9
(bts=0) ACC RAMP: allowing Access Control Class 0
(bts=0) ACC RAMP: step interval set to 30 seconds based on 0% channel load average
(bts=0) ACC RAMP: allowing Access Control Class 1
(bts=0) ACC RAMP: step interval set to 354 seconds based on 59% channel load average
(bts=0) ACC RAMP: allowing Access Control Class 2
(bts=0) ACC RAMP: step interval set to 30 seconds based on 0% channel load average
(bts=0) ACC RAMP: allowing Access Control Class 3
(bts=0) ACC RAMP: step interval set to 30 seconds based on 0% channel load average

Change-Id: I0a5ac3a08f992f326435944f17e0a9171911afb0
Related: OS#2591
2018-02-27 14:29:39 +00:00
Neels Hofmeyr 909e972787 HO: Implement load based handover, as handover_decision_2.c
Change-Id: Ie597eae82722baf32546331e443dd9d94f1f25e6
2018-02-19 17:11:47 +01:00
Neels Hofmeyr ec42264113 HO: clearly mark conn penalty timer member for hodec2
The conn's penalty timers will be used only for handover decision 2, make it
clear by a sub-struct.

hodec2 will also initialize the penalty timer list on demand only, so no need
to always initialize.

Change-Id: Ie6c2bc2b10dc424dfd94a9e11a9a62f51c48aa10
2018-02-19 17:11:29 +01:00
Neels Hofmeyr 35ba85c37d HO: lchan: store last seen measurement report nr, tweak log
Handover decision 2 will also store the last seen mr nr for neighbor cell
measurements and hence can tell whether a neighbor's measurement is outdated.

Change-Id: Ic1148364597f91b5a55666c80c758b61fa56f582
2018-02-19 15:51:18 +00:00
Harald Welte 51e4bf3298 Permit set of multiple different A5 ciphers
So far, the administrator had to pick one particular cipher which
would then be used throughout all subscribers/phones. This is a bit
impractical, as e.g. not all phones support A5/3.  Extend the VTY
command syntax in a backwards-compatible way to permit for multiple
ciphers.

The bit-mask of permitted ciphers from the MSC (sent in ASSIGNMENT
COMMAND) is intersected with the vty-configured mask a the BSC.
Finally, the best (highest) possible cipher is chosen.

Change-Id: I1d1c8131855bcab2392b4f27f6216bdb2fae10e0
Closes: OS#2461
2018-02-19 11:43:07 +01:00
Harald Welte 519c7e1d42 Structural reform: Get rid of osmo_bsc_sccp_con
There was always a 1:1 correspondence between gsm_subscriber_connection
and osmo_bsc_sccp_con, so there's really no point in having two separate
dynamically allocated data structures with pointers back and forth and
another linked list around.

Let's merge osmo_bsc_sccp_con into gsm_subscriber_connection for
simplicity.

The resulting code might not be elegant in places, but I've tried to
do only the most simple changes in this patch, while further
simplifications can be done in later subsequent patches.

As a side-effect, this patch also fixes lchan clearing if the MSC
(or the local SCCP provider) hard-disconnects the SCCP connection.

Change-Id: Idd2b733477ee90d24dec369755a00f1c39c93f39
2018-02-19 08:20:35 +00:00
Neels Hofmeyr a60f344212 HO: store speech codec list from BSSMAP Assignment in conn
On BSSMAP Assignment Request received from the MSC, store the Speech Codec List
in the subscr conn, so that we may evaluate available codecs during handover
decision. (Will be used, e.g., by handover_decision_2.)

Change-Id: I8222d73085eb777696e365c94214c05d56e6d129
2018-02-16 16:11:16 +01:00
Neels Hofmeyr cbdfb78f7b HO: move penalty timers to own file as proper API
Separate penalty timers API from specific struct members and move to own .h/.c
file, so that future code may re-use the API arbitrarily.

Change-Id: Ife975a1c7c17a500b1693be620475a8bea72f86f
2018-02-16 16:11:16 +01:00
Neels Hofmeyr 91004ab734 gsm_network: drop unused subscr_epxire_timer
Change-Id: I2e34ffb35e244472f8bfc993facc8d6e130f10d9
2018-02-14 12:55:45 +01:00
Neels Hofmeyr 28838e9aaa drop unused common.h
Change-Id: I7cf4076d7e36ae71d88e70a86d5c2d0640c1146f
2018-02-14 12:55:45 +01:00
Neels Hofmeyr d23ce86c25 drop libcommon-cs completely
Change-Id: I07d4a48af3154ee4d904686f230a51b8b8a94ff9
2018-02-14 12:55:45 +01:00
Neels Hofmeyr 92b9f2ecd4 common_cs.h: mv gsm_encr to gsm_data.h
This leaves common_cs.h practically empty. Leave its removal to the next patch,
which removes libcommon-cs entirely
(I07d4a48af3154ee4d904686f230a51b8b8a94ff9).

Change-Id: Ic3233f03580aa8c0ab178dfd33e68ecab5b9f042
2018-02-14 12:55:45 +01:00