Both callers of cleanup_attr_msg(), i.e. handle_attrs_trx() and
handle_attrs_bts(), always pass out_offset >= 1, so the length
of the unsupported attributes counter is already accounted.
Otherwise, both callers would copy an additional garbage byte
from uninitialized memory. Discovered using Valgrind:
DOML DEBUG oml.c:539 OC=BTS(01) INST=(ff,ff,ff) Rx GET ATTR
DOML INFO oml.c:265 BTS Tx Get Attribute Response
==25467== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==25467== at 0x623E0BD: send (send.c:27)
==25467== by 0x5685846: __handle_ts1_write (ipaccess.c:358)
==25467== by 0x5683F8B: ipa_client_write (ipa.c:79)
==25467== by 0x5683F8B: ipa_client_fd_cb (ipa.c:140)
==25467== by 0x5F1DC23: osmo_fd_disp_fds (select.c:223)
==25467== by 0x5F1DC23: osmo_select_main (select.c:263)
==25467== by 0x42980B: bts_main (main.c:354)
==25467== by 0x6160F44: (below main) (libc-start.c:287)
==25467== Address 0x7d83895 is 23,669 bytes inside a block of size 102,528 alloc'd
==25467== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25467== by 0x589A6B4: talloc_pool (in /usr/lib/x86_64-linux-gnu/libtalloc.so.2.1.5)
==25467== by 0x5F1E28B: msgb_talloc_ctx_init (msgb.c:316)
==25467== by 0x4293D0: bts_main (main.c:234)
==25467== by 0x6160F44: (below main) (libc-start.c:287)
==25467== Uninitialised value was created by a stack allocation
==25467== at 0x415FE5: oml_tx_attr_resp (oml.c:259)
==25467== by 0x415FE5: oml_rx_get_attr (oml.c:561)
==25467==
Change-Id: Ic7c2c4e54e9f99b60aaf70604044933978be945c
Related: OS#3938
It was noticed that the Get Attribute Response message always
indicates BTS(00,ff,ff) as the addressed OML entity, even if
e.g. Baseband Transceiver(00,00,ff) was requested by the BSC.
Despite neither OsmoBSC nor OpenBSC does complain about this,
such behaviour violates 3GPP TS 52.021. Let's fix this.
Change-Id: Icb1ee75d4bf680deb6365288d8c2053816a12217
Related: OS#3938
When using %lu and sizeof() for printing the compiler may throw a
warning. Lets prevent this by using %zu instead of %lu as conversion
specifier.
Change-Id: If5cb656537b1b73b9361a132801ab47ab7f8a709
The functions oc2gbts_par_get_uptime() and oc2gbts_par_set_uptime() try
to return with NULL, but both functions are declared as int. Lets return
-EINVAL instead.
Change-Id: I63b61be2940c59b221089d3d1501371b0116d89a
fsync() takes an integer file descriptor but we have a *FILE pointer
here. Lets use fileno() first to convert the integer file descriptor to
a FILE pointer.
Change-Id: I46ffd8c680ba0b445cbbd133d5ce92b79e3d8d87
the function bts_cbch_get() is used in l1_if.c. The function is
declared in cbch.h. Lets include this header file in order to be
complete.
Change-Id: I95d7e89eed969dd5b3ccff0eebcc6c568196a97d
In oml_send_msg() we optionally push the A-bis IPA magic string
("com.ipaccess") to a given message buffer as LV (Length Value),
including the terminating null byte ('\0').
There was a mix of both sizeof() and strlen() calls, and worse
luck, memcpy() has been used in a wrong way, skipping the '\0':
memcpy(dest, src, strlen(src));
In general, this is not critical because the headroom of a given
message buffer would most likely be zero-initialized, so the '\0'
is already there. However, msgb_push() gives no such guarantee.
Let's use the libosmocore's TLV API (in particular, lv_put()),
and stick to sizeof(), so the null byte will always be included.
Change-Id: I0c7f8776d0caec40f9ed992db541f43b732e47ae
Closes: OS#3022
As specified in 3GPP TS 03.60 Section 16.2.1 and 44.018 Section 3.4.15,
a Class B MS is sending a "RR GPRS SUSPEND REQ" via a DCCH to the BTS if
it wants to suspend GPRS services. The BSS is now responsible to
somehow forward this to the SGSN. As the Gs interface between BSC and
SGSN is both optional and doesn't have any provision to forward this
message, we have to send it over to the PCU so it can use regular BSSGP
signaling to inform the SGSN of the SUSPEND REQUEST.
This patch requires libosmocore Change-Id
I90113044460a6c511ced14f588876c4280d1cac7 for the related definition of
struct gsm48_gprs_susp_req.
Change-Id: I3c1af662c8f0d3d22da200638480f6ef05c3ed1f
Closes: OS#2249
At some locations in the code a signal to SS_FAIL is dispatched in order
to trigger the sending of an OML failure event report in oml.c. This is
a bit overcomplicated for the task. Lets use oml_tx_failure_event_rep()
to send the failure event reports and lets remove the signal handler for
SS_FAIL.
Change-Id: Ie4fce1273a19cc14f37ff6fc7582b2945c7e7c47
Related: OS#3843
The function oml_tx_failure_event_rep() replaces oml_fail_rep(), so lets
use only oml_tx_failure_event_rep() and remove oml_fail_rep()
Change-Id: I83c4fa9ebd519299fd54b37b5d95d6d7c1da24f6
Related: OS#3843
SIGUSR1/2 and SIGABRT should not trigger a failure event report on
OML since we only use it to get an intermediate talloc report. (In
case of SIGUSR1/2 without leaving the process.)
Change-Id: I99e637496afff2530425b89c6e9befc76db24906
The function gsmnet_from_vty() is used in oc2gbts_vty.c, but it is not
declared in vty.h. Lets add the declaration to vty.h, so that
gsmnet_from_vty() can be used properly by other modules.
Change-Id: I8cf63c6fabdb1f2dc67ca8193704ce4d1d4882d9
Nowadays only known users (OE images) use systemd and don't require this
kind of screen setup.
In any case, this kind of file belongs to scpeific setup and are not
needed here.
Change-Id: I65b0eee44336e4627620443861092b8988f2e01d
This fixes the below compile error:
rsl.c:900:43: error: ‘gsm0808_chosen_enc_alg_names’ undeclared (first use in this function)
Change-Id: I4aed0242737602e61b785862e3c37c963bf48455
The log level of the messages that notify calibration file loading
problems is NOTICE, but since it is a severe problem when calibration
can not be loaded lets change it to FATAL
Change-Id: I32aed25ca7925f1c776f00b37f404a58a85ddbc7
Related: OS#3823
When the TX/RX calibration files can not be loaded a failure event
report should be sent to the BSC. Lets send a failure event report when
calbration data is either bad or can not be loaded (see also remvoed TODOs).
Change-Id: I3318470518b34807a443f7cb78c7091b4a3d4481
Related OS#3823
On links with high latency it can happen that RADIO CARRIER OPSTART is
carried out to early, even before SET BTS ATTRIBUTES is carried out.
This means that important parameters for the initalization are not yet
set and the TRX initalization failed. Lets delay the TRX initalization a
bit in order to be sure that all BTS attributes are set before the
initalization is carried out.
Change-Id: Id3bdc88d28417e422d2c0c33b03be06f1a4706c2
Related: OS#3782
The function vty_install_default() is deprecated and throws a compiler
warning that suggests to remove it, so lets remove it.
Change-Id: I1a4afb6e352bed9a5af794b39b984a7ddef36e08
The static function oml_tx_failure_event_rep() is a lot easier to use
than the currently implemented signal scheme. Lets make it public so
that we can quickly generate failure event reports.
Change-Id: I9c4601840a06119f35cfe4da453fff3b293fe615
Related: OS#3823
According to the OC-2G product specifiacation, the maximum output power
is 25 dBm. This should be reflected in the code, there's no point in
claiming to be able to trnasmit 40 dBm - which just creates confusion on
all levels (such as the logs, where Tx power is claimed to be ramped up
to 40 dBm right now).
Closes: OS#3823
Change-Id: Ia6b3476ab2f9279f8905b8c7cfd07ef7b0a939ed
For some strange historical reason, the baseband transceiver MO was
brought up in state "UNLOCKED".
The object should come up in "locked" state until it's explicitly
unlocked by the BSC.
See Section 6.8.2 of TS 12.21: "If there is yet no administrative state
value explicitly set by the BSC (e.g., at an initialization time), the
object shall be presumed to be administratively locked by default"
Change-Id: Id505594b9f224567566caac84dae2e2ae4477fae
Closes: OS#3790
For the TS 12.21 standard OML attributes, we store a copy of the
most-recently set value for each attribute in "mo->nm_attr". This
somehow was missed when adding support for the IPA specific MOs like
those relevant for GPRS.
Change-Id: I75ebda46da9c1fcecc484311bf3833f31c536ee1
Fix compilation warning. At runtime it's not a big issue because the
"list" field is the first field of the led_list (struct
lc15bts_led_timer_list) variable. Hence, the address passed is the same.
Similar to commit fixing same issue in lc15 in 080302f8.
Change-Id: Ie393a21bc3a725520343c70941cb4f591b313420
it's used in oc2g/main.c and it needs to be in a header file.
Similar as previously done for lc15 in 19795c5a.
Change-Id: Ic6826d8c8ff5c648158493454a80704bb956b51d
When the ph-data indications for the PDTCH are passed up to l1sap,
then a forumla is used to calculate the frame number of the beginning of
the block that is just passed up. This is not necessary since the start
frame number of the block is stored in *first_fn when the block arrives.
We should use this frame number instead. (For the measurement indication
it is already done this way).
Change-Id: I6c01987be78203acfa689c6decb2c806f8fff3d6
Related: OS#2977
Attempt to decode incoming RACH burst as 11-bit first
and fallback to 8-bit if unsuccessful.
Change-Id: Ia28741603636406744e5e22ffff1fb7a9689955a
Related: OS#1854
OsmoBSC used to have a bug in encoding the "GET ATTRIBUTES" OML message,
resulting in the actual message length being three bytes longer than the
encoded length value.
As in Ib98f0d7c2cff9172714ed18667c02564540d65d7 we have introduced
proper consistency checks on length values, all "GET ATTRIBUTES" from
OsmoBSC version suntil today will fail. This patch introduces a
work-around to remain compatible with old OsmoBSC while still keeping
the consistency checks for all other messages.
Change-Id: Ifa24e9e2c71feb2c597557807d675438c2825b2d
Related: OS#3799
For OML, what matters is the length indicated in the OML message header.
If we don't have sufficient bytes, reject the message and send a failure
event report.
If we have more bytes, truncate the message at the number of bytes
indicated in the OML length header.
Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7
TS 12.21 describes segmenting of OML messages using placement
fist/middle/last and the "sequence' number of the OML header. We don't
implement this and hence must ignore or reject any related messages.
Before this patch however, we simply treated such segments as if they
were a complete OML message. Let's fix that.
Change-Id: Idd42cf4edc1bf9ab366853bd9b0f7afd9c060910
Closes: OS#3795
Simply use a "mo" variable on the stack rather than having duplicate
but otherwise identical calls to oml_tx_failure_event_rep()
Change-Id: Ibe6c79e95405b13d041047549d2ffa39aa355eb2
Vadim Yanitskiy
Philipp Maier
Harald Welte
Pau Espin