This is useful information to know and actually fixes a segfault
in rllp.c where lchan is accessed even tough it could be NULL in
case of failure.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Theses will be useful to know if we can reuse the tuples or if
we should renew. The 'issued' is currently purely informative.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This returns true if the gsm_nm_state can be considered 'running'.
Note that we also accept availability==0xff (which is a code for
no value) because according to 12.21 it is perfectly valid.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Thise two functions are interfacing with the 04.08 layer 3 to
determine if a particular message should be handled inside
the OpenBSC layer 3, or if it should be handled in the silent call
handler.
* On start the vty code will call the abis_nm method and this
will set the administrative state to unlock/lock
* During startup the BTS will report its state as well and would
possible overwrite the set administrative. We are only going
to update the administrative if it was 0 before. This appears
to work on all of my tests. In case this will not be the case
for others we will have to split the administrative into two
sets one for the BTS and one for the BSC.
* Do not issue the restart right aways if we have OML IP or
software load in the queue (hint, we need a real queue of operations
to carry out... with one big state machine)
* Change the signal_data of ipacc ACK/NACK to contain the msg type
and the bts pointer.
* Issue a restart for software load and OML and use the BTS pointer
we got out of the new signal data.
* text3 seems to be a version as the text content starts
with a 'v'
* move the sdp_firmware into the ipaccess.h and declare
the function. The headers are returned through a list.
In many cases we actually want a name / unique ID for the lchan,
not just for the on-air timeslot... especially in SDCCH/8 case,
where 8 SDCCHs share one timeslot...
When we allocate a channel, we send the RSL CHAN ACT REQ and wait until we get
a CHAN ACT ACK. Only the ACK will change the state, so there is a race where
we allocate that same channel to a different channel request before we get
the ACT ACK.
Introducing a new ACT_REQ state resolves this issue.
Change the counters_store_db function to be a generic for_each
function taking a function pointer and data. Use that in bsc_hack
to store it to the DB.
This is removing the DB requirement and will allow to handle
the counter values in different ways without making the counter
list public.
I verified that the syncing is still taking place.
This is the new logging architecture, including
* support for multiuple logging targets like stderr and vty
* log levels in addition to categories/subsystems
* filtering based on imsi, i.e. only see events for one subscriber
* dynamically change log level for each category for each vty
This has the advantage that counters can be added all over the code
very easily, while having only one routine that stores all of the
current counter values to the database. The counters are synced
every 60 seconds, providing relatively fine grained statistics
about the network usage as time passes by.
Tweaking theses can be useful especially tx-integer that influence
both the spread of rach attemps and the delay between two attemps.
Looking up GSM 04.08 3.3.1.1.2 & 10.5.2.29 can help determine good
values. The default are choosed with a wide spacing between attemps
(tx integer = 9 -> T=12 & S=217 (non-combined CCCH/SDCCH) or 115 (for
combined CCCH/SDCCH)). This alleviates the problem of responding to
several RACH attempts by a same MS, allocating several RF channels when
only 1 is needed.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This implements the handover algorithm (and associated parameters)
as described in Chapter 8 of the book "Performance Enhancements in
a Frequency |Hopping GSM Network" by Thomas Toftegard Nielsen and Jeroen
Wigard.
The parameters such as averaging windows are configured in struct
gsm_network. We keep some state to trakc up to 10 neighbors as
they are being reported from the MS.
This has so far only been tested in a network with two BTS that
have each other as neighbor. Networks with morge neighbors might
encounter bugs.
This allows us to block packets that we have received after the channel
is no longer being used. This is visible during handover, where we still
receive a measurement report after the MS has switched to the new channel.
This leftover measurement report then attempts to trigger another handover,
which si bogus and will fail - and thus only consumes resources.
With the new LCHAN_S_ACTIVE state, we can check for this when processing
the measurement report.
This provides two functions: get_meas_rep_avg() to obtain the sliding
window average of one particular field, and meas_rep_n_out_of_m_be()
to check if at least N out of M measurments are >= BE.
During handover, we will not send RTP frames for quite some time. However,
the way the rtp_send code is structured, it will increment the timestamp
with a fixed amount every time we send a frame, independent how much wallclock
time has actually passed.
This code is a hack to update the sequence number and timestamp in case it
seems to be wrong. It makes handover much more reliable.
Instead of passing TRAU frames down the MNCC API to the call control
application like MNCC, we now decode the TRAU frame into the actual codec
frame. We do the same with the RTP packets in case of ip.access and
thus have a unified format of passing codec data from the BTS to
an application, independent of the BTS type.
This is only implemented for V1 full-rate at the moment, and needs
to be fixed.
This introduces a new LOGP() macro together with LOGL_* definition to
support multiple log levels (severities) throughout the codebase.
Please note that the actual logging system does not use them yet,
in this patch we simply introduce the new macros at the caller site.
With this commit, we can successfully hand over a channel from one cell to
another cell. We implement asynchronous intra-BSC (but inter-BTS) handover.
Changes:
* introduce new DHO log category
* extend rsl_chan_activate_lchan() with argument for HO reference
* introduce actual minimal handover decision making in handover_decision.c
* various fixes to bsc_handover_start() in handover_logic.c
We will need this for the actual handover algorithm implementation, as we will
only know the current BTS and the BCCH ARFCN of the strongest cell in the
measurement reports. Using this new function, we can resolve the matching
gsm_bts.
Since we are keeping a bitvec of the neighbor cells, we can now use
bitvec_get_nth_set_bit() to determine the ARFCN for each reported
cell in the 04.08 MEASUREMENT REPORT.
We use a 1024-bit-sized bitvec to generate the BA and neighbor frequency list.
This bitvec is still generated from the list of all BTS's inside the BSC, but
this patch is the first step to generalize this, i.e. generate arbitrary
neighbor lists.
* introduce a new bitvec_get_bit_pos() function to determine the bit value
at a given position inside a bit vector
* make sure bitvec_{get,set}_bit_pos() share code as possible
With ip.access, in case of TCH/H, we have one RTP stream for each half-slot
(lchan), not just one per on-air timeslot. This is quite different from
a classic BTS where the TRAU frames of the two TCH/H channels would be
part of the same 16k sub-slot in a E1 timeslot.
Before this commit, OpenBSC used templates for the SYSTEM INFO
1, 2, 3, 4, 5 and 6 messages. Those templates were patched in
various places to reflect the network config like ARFCN.
Now, we actually generate those SI messages ourselves, using
values from the configuration file, and even calculating neighbor
cell lists.
All bts'es that you have configured in OpenBSC will end up in
the neighbor cell list - which should be more than sufficient for
the current small-single-site networks.
Code to implement handover control logic. A yet-to-be-implemented
handover algorithm will call bsc_handover_start(old_lchan, new_bts)
to start the handover process.
This introduces the signals S_LCHAN_ACTIVATE_{ACK,NACK} and
S_LCAN_HANDOVER_{FAIL,COMPL,DETECT} as well as code that actually issues
those signals. The signals are relevant for a yet-to-be-written handover
control logic.
This is needed by a yet-to-be-implemented handover algorithm, after
it has allocated a new lchan for the MS. Also missing: handling
the actual HANDOVER COMPLETE / FAIL messages in response.
This patch extends struct gsm_meas_rep into a complete structure containing all
information from both uplink and downlink measurement results/reports.
This is a first step to provide this complete measurement data as a C structure
into a to-be-implemented handover decision algorithm.
- Make sure that on runtime the Radio Carrier can be
locked and unlocked. The vty code calls into the
Abis NM to lock/unlock the channel and the state is
stored there.
- Make sure that on start the Radio Carries remains
offline and we are not starting it. On start the
radio carrier is either locked or unlocked. This means
the RSL will not connect until the RF is unlocked. It
will connect then. To see RSL bringup failures one
needs to parse the RSL nack message.
- When the TRX is locked on startup the RSL link will
only be established after it will be unlocked.
The python script is a simple call-agent driving the
client. Currently it is sending a AuditEndpoint message
and is printing the result.
The bsc_mgcp.c is a standalone process that will implement
a MGCP Gateway for the MSC. On call handling the Call-Agent
will ask the Gateway to "CreateConnection" and then this
gateway needs to communicate with OpenBSC.
Currently CreateConnection,ModifiyConnection,DeleteConnection
and Endpoint auditing is implemented.
[mgcp] Send RSIP on start and on first receive of any message
Ignore the first request and send a RSIP. We do that because
we might tunnel UDP through some other things and have no direct
way to connect to the call-agent.
Also the transaction is not checked and we ignore the response
from the call-agent, actually we print the '200 ' or any other
value as unhandled...
[mgcp] Print the MGCP command next to the response code
This allows to see which commands were sent by the server
mgcp: Terminate it with a new line
[mgcp] Make number of endpoints static...
For now this is fixed to the number of endpoints as of the GSM
specification...
[mgcp] The endpoint names seem to be base 16... use strtoul to parse
Use strtoul to parse the base 16 number from the mgw string.
[mgcp] Log the endpoints as hex numbers...
[mgcp] Only send the RSIP on the first incoming message..
Remove call_agent option (also remove the number from the getopt
call).
[mgcp] Start couting at 1 for the mgcp
[mgcp] Slight attempt to improve the grammar of the strings
[mgcp] Share validation routines between DLCX and MDCX
[mgcp] Remove help for dead config options
[mgcp] Specify a different IN addr in the SDP records
In case of NAT traversal be able to listen on a given
interface (like 127.0.0.1) but claim to receive data
at the beginning of the tunnel.
[mgcp] Fix the static copy of the SDP file
WIP verify out factoring broken..
[mgcp] Introduce VTY to the mgcp for config file parsing...
Parse the MGCP config file via the VTY framework.
[mgcp] Handle SDP parameters through VTY..
Currently the payload type, name and rate can be specified
in the config file.
[mgcp] Add an option to bind all rtp ports early
This can be useful for testing and in deployment to make sure
no runtime resource limit can be hit.
[mgcp] Add some API doc comment
[mgcp] Convert the packets of the example server to ascii
This will allow to easily patch the call id... to run the
server in a loop and make it work with the mediagateway
[mgcp] Assign CI_UNUSED... to be more obvious...
[mgcp] Use DEBUG and not DEBUGPC and specially not printf
Improve the logging a bit in the mgcp
[mgcp] Change the fake server to change the call id
This assume the call-agent will just increment the id
as well.... this is true for our implementation
[mgcp] Generate the transaction id dynamically..
This way wireshark will be more happy about it...
[mgcp] Recognize responses from the network..
This is just recognizing the response code and
then is doing nothing with it. Also change the
script to generate response messages...
[mgcp] Improve debug messages for CRCX/MDCX..
Log on which ports the media gateway is listening
and where the other (server) gateway is located
Both GSM 04.08 RR and GSM 08.58 RSL need the multirate config
in the channel modify. Place the config in the lchan, change
the gsm48 methods to not take the argument, change the RSL
implementation to make use of it with the right IE.
The other code should use the t(l)v_put routines as well but
were left untouched for now.
IPA is naming these functions CRCX, MDCX, DLCX to follow
the naming of the MediaGatewayControlProtocol. Change the
code to go from BIND to CRCX (create connection) and from
CONNECT to MDCX (modify connection).
Connect indicates that it is only possible to call it once
while it is possible to call it more than once to modify
the audio parmaters and such. So the IPA terminology is
making a bit more sense here (now that we know it).
E.g. to analyze the subscr_get/subscr_put behavior one can place
the generate_backtrace into the functions, recompile and then filter
the output with contrib/bt.py to get the function name, file and line.
On channel mode modify and assignment command when using
the a multirate code the multirate configuration must be
present in the packet.
Add a parameter and add a warning when using it in a
broken way.
Allow to handle the channel requested differently based
on the NECI value for the "paging any" case. This will allow
to open a TCH/H, TCH/F depending on the neci mode.
This allows the administrator to use the vty interface to issue a silent
call to a given subscriber by using
"subscriber extension XXXX silent call start"
and stopping that silent call with
"subscriber extension XXXX silent call stop"
This is confirmed by looking at the source of their dissector.
The length can go up to 273 bytes apparently (again, according
to the source of their dissector).
Keep track of which SAPIs have been established either by the
BTS (from the MS) or by us. This can be used by the on-waves
BSC code to figure out if a new request should be made.
Be able to send RR CHANNEL MODIFY from the BSC/MSC code
as well. Move the method that knows about the IPAccess RTP
and issues the "bind" to the utils tool
Add code to generate an assignment command for a given lchan. It
is expected that the lchan is modified already and the mode will
be picked up from their. Currently only the mandantory items
are supported.
- Improved handling of extension-number string (as per review)
- Guard against a buffer-overflow if mobile sends a too-long USSD
- declare some function-parameters const
- fix gsm_ts_name function to display the right BTS number (bts->nr rather than bts->bts_nr)
This patch removes the need of static global variables and introduces a new,
caller-allocated 'struct ussd_request' that needs to be passed to the various
functions.
This is needed when you need to manually parse TLV blocks
that don't follow the logic supported by tlv_parse but you
still want to rely on working code and not fiddle with details.
If we have a dynamic TCH/F / PDCH channel configuration, then
we can either ACTIVATE CHANNEL it for a TCH/F, or we need to send
this vendor-specific PDCH ACTIVATE command to use it as a PDCH.
As opposed to a fixed configuration, this allows an intelligent
BSC channel allocator to use otherwise idle channels as PDCH
as long as no more TCH's are needed.
Since TS 12.21 implements only SET ATTRIBUTE for some object classes,
ip.access had to extend it to be able to set attributes on arbitrary
objects. We now introduce a function implementing that message.
Supporting GPRS means we have a number of additional OML objects to
deal with. We need to extend our gsm_bts structure to at least
include the nm_state for each of those objects.
Tag-variableLength-Value is an encoding scheme used in the GPRS NS
and BSSGP protocols, where the length value can be 8 or 16 bits,
depending on actual demand.
Partially apply 9ba65525eaa06a1768aaf35bdee98afcf8026e0a to get
rid of a compile problem. The other part of the mentioned commit
is still in the gprs branch.
Signed-off-by: Holger Hans Peter Freyther <zecke@selfish.org>
Add support for 1900 nanoBTS by using unified bts_type
GSM_BTS_TYPE_NANOBTS for 900, 1800 and 1900 versions.
Reduce the nanoBTS enum values to one and derive the
version from the user supplied band. In the future we
might want to do auto band detection.
The configuration file needs to be changed to refer
to nanobts instead of nanobts900/nanobts1800.
Signed-off-by: Mike Haben <michael.haben@btinternet.com>
Signed-off-by: Holger Hans Peter Freyther <zecke@selfish.org>
We are using LAC=0 for remembering that a GSM subscriber is
detached. I recently added code to gsm_bts_by_lac that will
return every BTS in case the lac is 0. Harald highlightes
that we would now search for detached subscribers at every
BTS of our network which is clearly not what we want.
Introduce two defines for the two reserved LAC, add a
pointer to the specification, check that our config files
do not contain these reserved values, use the define
and change gsm_bts_by_lac to use the other define.
For the MSC<->BSC connection we are going to use the same header
as used from BTS<->BSC but we are not having an E1-Link, a gsm network
or a gsm_bts available and can not use this part of the code.
The LAC can be 16bit of size. the generation of the LAI, struct
gsm_subsriber and the BSC<->MSC was already using it as a
16bit (short) value.
Change struct gsm_bts to parse 16bit and change the vty configuration
parsing code to deal with a short too.
Add one method to extract the MI which will allow to load
the gsm_subscriber depending on the MSC/BSC setup and then
use gsm48_handle_paging_resp to finish the paging response
handling.
Transfering the cell_identity from BSC to MSC is required for the
on-waves.com support. Allow to set the cell_identity in the cfg
file and patch the system information tables to set it.
tmsi is four octets long, there is no need to make it a string
and then jump through hoops to convert it to a number. Keep the database
using it as a string to benefit from the NULL handling of the db.
Introduce the reserved tmsi which has all bits set to 1 according
to GSM 03.03 §2.4 and start checking for it and make sure the db
code will never allocate such a tmsi.
This just adds the 04.08 and RSL bits for A5, but not the logic
for performing authentication.
The caller would first set lchan->encr and then call
gsm48_send_rr_ciph_mode(lchan), which encapsulates the 04.08
CIPHERING MODE COMMAND into a RSL ENCRYPTION COMMAND and sends it
to the BTS for execution + forwarding.
Prefix generate_mid_from_tmsi with a gsm48_, create a new method
to binary encode the imsi. Add a unit test for parsing and decoding.
The implementation can parse the data it generated and the
last octet seems to be filled with the end mark.
The existing gsm_04_08.c implementation is mixing BSC and MSC
behavior. Move some simple parsing and generation functions over
to gsm_04_08_utils.c to allow a different MSC to define the policy.
this enables the caller to detect if the paging request was rejected
by the paging layer, especially in case it is already paging this very
subscriber.
In the case of SMS / 04.11, we used to have a memory leak of struct gsm_sms's,
since we would only free them from the paging succeeded/expired callbacks.
SMS related messages are all sent over SAPI=3. But in addition
to that, we also need to send it over the correct link identifier,
i.e. SACCH or main signalling channel
The channel allocator can be set in ascending or descending order.
Ascnending means we first try to allocate channels on TRX0, then TRX1, etc.
Descending means we first try to allocate cahnnels on TRXn, then n-1 down to 0.
SM's need to be transferred over their own RLL connection on SAPI3, rather than
the default SAPI0 connection that we're using for signalling like 04.08
RR/MM/CC.
This is not that much of a problem in the case of SMS SUBMIT from the MS to
the netwrok. In that case, the MS will start its primary RLL connection
with SAPI3, and we can just respond with SAPI3.
However, in the case of SMS DELIVER to a MS, we first page the MS, it then
establishes SAPI0. We then need to explicitly request the establishment of
a SAPI3 RLL connection, before we can send CP-DATA with our RP-DATA and DELIVER
RPDU
Now that we have the bsc_rll.c code, we can actually wait for a paging
response, and from the paging response request the establishment of the SAPI3
connection. We will be called back once that connection is open and can
successively start transmission of the SM.
A caller can call rll_establish(lchan, link_id) and a callback to the GSM RLL
code. He will get called back if the RLL link is established or receives some
error message, or the establishment times out.
We need this for proper SMS implementation, where we need to restablish a SAPI3
RLL link before transmitting the actual CP-DATA messages.
we now have the full path from the MS into the database (SUBMIT), as well as
back from the database to the MS (DELIVER). The database gets correctly
updated once a SMS has been successfully delivered.
What's still missing is the periodic scan over all undelivered messages,
trying to deliver them to the respective MS. So far, you have to manually
trigger this on the telnet interface with 'sms send pending 1'
So far, we immediately disable the RF channel without following a proper
RLL RELEASE procedure. This patch changes this.
If we locally terminate the connection, the channel allocator now triggers a
RLL RELEASE REQuest, which is responsed by the MS with a RLL RELEASE CONFirm,
based on which we send the RF CHANnel RELease to the BTS.
If the MS terminates the connection, we receive a RLL RELEASE INDication,
based on which we trigger RF CHANnel RELease to the BTS.
This helps us to detect the frequency error of BS-11 if it is located
next to the nanoBTS 900.
If 'ipaccess-config -l' is called, it will produce a report like
<0020> ipaccess-config.c:85 TEST REPORT: test_no=0x42 test_res=0
<0020> ipaccess-config.c:108 ==> ARFCN 220, Frequency Error 22
<0020> ipaccess-config.c:108 ==> ARFCN 1, Frequency Error -37
<0020> ipaccess-config.c:108 ==> ARFCN 10, Frequency Error 0
<0020> ipaccess-config.c:108 ==> ARFCN 20, Frequency Error 11
<0020> ipaccess-config.c:108 ==> ARFCN 53, Frequency Error 5
<0020> ipaccess-config.c:108 ==> ARFCN 63, Frequency Error -4
<0020> ipaccess-config.c:108 ==> ARFCN 84, Frequency Error 11
<0020> ipaccess-config.c:108 ==> ARFCN 101, Frequency Error 0
<0020> ipaccess-config.c:108 ==> ARFCN 123, Frequency Error -52
where in this case the ARFCN 123 is the BS-11 with a frequency error
larger than all the other (regular) BTS in the vicinity.
* we only need one piece of code to calculate rsl_ie_chan_mode from
our run-time data structures (gsm_lchan)
* add some more channel modes for TCH/H and data
* use enum's to make the compiler warn us about unhandled enum values
* make sure the caller determines the (signalling,speech,data) mode
Up until now, we only supported direct RTP streams between ip.access BTS.
With this commit, the user can specify '-P' to the command line to enable
a RTP/RTCP proxy inside OpenBSC. The nanoBTS will then send all their voice
data to OpenBSC, which will relay it to the respective destination BTS (which
can be the same BTS).
The default behaviour remains unchanged. Without '-P' on the command line,
RTP/RTCP is exchanged directly.
The rtp_proxy.[ch] code is intended to be used as a transparent
RTP/RTCP proxy, relaying the media streams from one ip.access BTS
to another. In an 'ideal' network, this is obviously not needed,
since the BTS's can send those streams directly between each other.
However, for debugging, 'lawful interception', transcoding or interfacing
a TRAU/E1 based BTS, we actually need to process those RTP streams
ourselves.
There were many places in the code where we had to explicitly
reference the transaction_id and put it into a packet. By introducing
and optional gsm_trans parameter to gsm48_sendmsg(), we can implement
this code once rather than dozens of time.
since a subscriber is an element of the gsm_network, we have to ensure
subscr->net is always set correctly. We do this by using gsm_network
as an argument to all functions that resolve or create a subscriber.
Since a transaction is associated to a gsm_subscriber, and the subsciber
is part of a network, we don't need to have a dedicated transaction->network
pointer.
This changeset factors out gsm_transaction as something independent
of call control in preparation to re-use the code from SMS. A
transaction is uniquely identified by either its callref, or by
a tuple of (transaction_id, protocol, subscriber).
Since a transaction is associated to a gsm_subscriber, and the subsciber
is part of a network, we don't need to have a dedicated transaction->network
pointer.
This changeset factors out gsm_transaction as something independent
of call control in preparation to re-use the code from SMS. A
transaction is uniquely identified by either its callref, or by
a tuple of (transaction_id, protocol, subscriber).
since a subscriber is an element of the gsm_network, we have to ensure
subscr->net is always set correctly. We do this by using gsm_network
as an argument to all functions that resolve or create a subscriber.
Currently we send the attribute changes in a send and forget
fashion. But sometimes the nanoBTS is sending us a NACK, e.g
with a invalid unit id. Start handling the NACK and provide
an error message to the user. The error message is not yet
describing the cause of the error but this is a slight progress
to the previous silent failure.
For further evaluation/analysis, this patch stores the classmark 1, 2 and 3
values of every equipment in the SQL database. We can use this non-volatile
data to determine the supported features for each handset that we've ever
seen on our network.
* describe data structures in gsm_04_11.h
* increae LCHAN RELEASE TIMEOUT for case of long SMS
* convert header field in sql table from NUMERIC to BLOB
* initial handling for validity period
* send RP ERROR messages with meaningful RP CAUSE in case of error
Daniel Willmann
Sylvain Munaut
Harald Welte