Code to implement handover control logic. A yet-to-be-implemented
handover algorithm will call bsc_handover_start(old_lchan, new_bts)
to start the handover process.
This introduces the signals S_LCHAN_ACTIVATE_{ACK,NACK} and
S_LCAN_HANDOVER_{FAIL,COMPL,DETECT} as well as code that actually issues
those signals. The signals are relevant for a yet-to-be-written handover
control logic.
This is needed by a yet-to-be-implemented handover algorithm, after
it has allocated a new lchan for the MS. Also missing: handling
the actual HANDOVER COMPLETE / FAIL messages in response.
This patch extends struct gsm_meas_rep into a complete structure containing all
information from both uplink and downlink measurement results/reports.
This is a first step to provide this complete measurement data as a C structure
into a to-be-implemented handover decision algorithm.
- Make sure that on runtime the Radio Carrier can be
locked and unlocked. The vty code calls into the
Abis NM to lock/unlock the channel and the state is
stored there.
- Make sure that on start the Radio Carries remains
offline and we are not starting it. On start the
radio carrier is either locked or unlocked. This means
the RSL will not connect until the RF is unlocked. It
will connect then. To see RSL bringup failures one
needs to parse the RSL nack message.
- When the TRX is locked on startup the RSL link will
only be established after it will be unlocked.
On cold start the RSL link will not be brought up. Wait for the
Software to be Activated before starting the RSL link. This is
working reliable on the BTS I have tested with.
This is a partial revert of 8406ec2437 and
was discussed on the mailinglist.
Allow to configure the number of endpoints at start. Currently
this will not be changed at runtime but one needs to save the
config and restart the system.
Forget where the bts and network is located on DLCX and CRCX otherwise
we would have forwarded BTS data to the wrong endpoint and would have
not tried to discover the BTS again.
In the case of early bind we might get data from the BTS before
the CRCX and after DLCX... just ignore it then
The python script is a simple call-agent driving the
client. Currently it is sending a AuditEndpoint message
and is printing the result.
The bsc_mgcp.c is a standalone process that will implement
a MGCP Gateway for the MSC. On call handling the Call-Agent
will ask the Gateway to "CreateConnection" and then this
gateway needs to communicate with OpenBSC.
Currently CreateConnection,ModifiyConnection,DeleteConnection
and Endpoint auditing is implemented.
[mgcp] Send RSIP on start and on first receive of any message
Ignore the first request and send a RSIP. We do that because
we might tunnel UDP through some other things and have no direct
way to connect to the call-agent.
Also the transaction is not checked and we ignore the response
from the call-agent, actually we print the '200 ' or any other
value as unhandled...
[mgcp] Print the MGCP command next to the response code
This allows to see which commands were sent by the server
mgcp: Terminate it with a new line
[mgcp] Make number of endpoints static...
For now this is fixed to the number of endpoints as of the GSM
specification...
[mgcp] The endpoint names seem to be base 16... use strtoul to parse
Use strtoul to parse the base 16 number from the mgw string.
[mgcp] Log the endpoints as hex numbers...
[mgcp] Only send the RSIP on the first incoming message..
Remove call_agent option (also remove the number from the getopt
call).
[mgcp] Start couting at 1 for the mgcp
[mgcp] Slight attempt to improve the grammar of the strings
[mgcp] Share validation routines between DLCX and MDCX
[mgcp] Remove help for dead config options
[mgcp] Specify a different IN addr in the SDP records
In case of NAT traversal be able to listen on a given
interface (like 127.0.0.1) but claim to receive data
at the beginning of the tunnel.
[mgcp] Fix the static copy of the SDP file
WIP verify out factoring broken..
[mgcp] Introduce VTY to the mgcp for config file parsing...
Parse the MGCP config file via the VTY framework.
[mgcp] Handle SDP parameters through VTY..
Currently the payload type, name and rate can be specified
in the config file.
[mgcp] Add an option to bind all rtp ports early
This can be useful for testing and in deployment to make sure
no runtime resource limit can be hit.
[mgcp] Add some API doc comment
[mgcp] Convert the packets of the example server to ascii
This will allow to easily patch the call id... to run the
server in a loop and make it work with the mediagateway
[mgcp] Assign CI_UNUSED... to be more obvious...
[mgcp] Use DEBUG and not DEBUGPC and specially not printf
Improve the logging a bit in the mgcp
[mgcp] Change the fake server to change the call id
This assume the call-agent will just increment the id
as well.... this is true for our implementation
[mgcp] Generate the transaction id dynamically..
This way wireshark will be more happy about it...
[mgcp] Recognize responses from the network..
This is just recognizing the response code and
then is doing nothing with it. Also change the
script to generate response messages...
[mgcp] Improve debug messages for CRCX/MDCX..
Log on which ports the media gateway is listening
and where the other (server) gateway is located
Currently this will send a dummy inactivity test message,
there is currently no parsing or API to receive the messages.
The sequencing and credit entries are empty as sequencing
is currently not used at all.
The test is currently limited to send the message and see
if the application is crashing or not.
include/sccp/sccp_types.h contain Q.713 and GSM definitions
include/sccp/sccp.h is the application interface resembling
the esentials of the UNIX socket interface.
src/sccp.c is the actual implementation of SCCP featuring
connection and UDT1 support.
tests/sccp/sccp.c is testing connection creation and formating
of the SCCP messages used by the A-interface. And
it contains a simple fuzzing test to test the
robustnes of the implementation.
Both GSM 04.08 RR and GSM 08.58 RSL need the multirate config
in the channel modify. Place the config in the lchan, change
the gsm48 methods to not take the argument, change the RSL
implementation to make use of it with the right IE.
The other code should use the t(l)v_put routines as well but
were left untouched for now.
IPA is naming these functions CRCX, MDCX, DLCX to follow
the naming of the MediaGatewayControlProtocol. Change the
code to go from BIND to CRCX (create connection) and from
CONNECT to MDCX (modify connection).
Connect indicates that it is only possible to call it once
while it is possible to call it more than once to modify
the audio parmaters and such. So the IPA terminology is
making a bit more sense here (now that we know it).
E.g. to analyze the subscr_get/subscr_put behavior one can place
the generate_backtrace into the functions, recompile and then filter
the output with contrib/bt.py to get the function name, file and line.
On channel mode modify and assignment command when using
the a multirate code the multirate configuration must be
present in the packet.
Add a parameter and add a warning when using it in a
broken way.
Allow to handle the channel requested differently based
on the NECI value for the "paging any" case. This will allow
to open a TCH/H, TCH/F depending on the neci mode.
Use the correct length when going over the array instead
of using the neci0 values. Remove the fixme from the method
as well as the issue has been addressed by adding a parameter
to the method.
Not doing this could lead to a double deletion due the paging
request being removed during the callback and afterwards as
well. Change the code to save the callback data, remove the
request, do the callback.
A patch was proposed by Andreas Eversberg and this one is
based on it.
This allows the administrator to use the vty interface to issue a silent
call to a given subscriber by using
"subscriber extension XXXX silent call start"
and stopping that silent call with
"subscriber extension XXXX silent call stop"
"Silent SMS" is a SMS that is delivered (and confirmed) but
not shown on the display of the phone. You can now send
such SMS by using
sms send silent extension 12345 text
or
sms send silent imsi 123451234512345 text
This will print test rep[orts that look like:
<0020> ipaccess-config.c:91 TEST REPORT: test_no=0x43 test_res=PARTIAL
<0020> ipaccess-config.c:140 ==> ARFCN 37, RxLev 24, RxQual 0: 262-1, LAC 13830 CI 10759
- Added function "gsm340_scts" to decode the service center time stamp
into a UTC/GMT timestamp
- in function gsm340_validity_period: can now decode validity period
format absolute.
In the case a transaction has been already scheduled return 0 was
called but the subscriber and transaction would leak. Fix it by
calling subscr_put and trans_free.
After claiming the channel also remove the reference on the subscr.
This is confirmed by looking at the source of their dissector.
The length can go up to 273 bytes apparently (again, according
to the source of their dissector).
Keep track of which SAPIs have been established either by the
BTS (from the MS) or by us. This can be used by the on-waves
BSC code to figure out if a new request should be made.
Be able to send RR CHANNEL MODIFY from the BSC/MSC code
as well. Move the method that knows about the IPAccess RTP
and issues the "bind" to the utils tool
Add code to generate an assignment command for a given lchan. It
is expected that the lchan is modified already and the mode will
be picked up from their. Currently only the mandantory items
are supported.
ipaccess-config stopped working after the introduction of
multi-TRX/RSL stream id support in commit 8175e95222.
Set the oml_tei to 0xff by default and add an option to set
a different stream id.
- Improved handling of extension-number string (as per review)
- Guard against a buffer-overflow if mobile sends a too-long USSD
- declare some function-parameters const
- fix gsm_ts_name function to display the right BTS number (bts->nr rather than bts->bts_nr)
This patch removes the need of static global variables and introduces a new,
caller-allocated 'struct ussd_request' that needs to be passed to the various
functions.
This is needed when you need to manually parse TLV blocks
that don't follow the logic supported by tlv_parse but you
still want to rely on working code and not fiddle with details.
bsc_init.c still contained a hard-coded channel configuration,
i.e. CCCH_combined on TS0 of C0, and TCH/F on all other channels.
Now it correctly uses the value as specified in the config file.
If we have a dynamic TCH/F / PDCH channel configuration, then
we can either ACTIVATE CHANNEL it for a TCH/F, or we need to send
this vendor-specific PDCH ACTIVATE command to use it as a PDCH.
As opposed to a fixed configuration, this allows an intelligent
BSC channel allocator to use otherwise idle channels as PDCH
as long as no more TCH's are needed.
Since TS 12.21 implements only SET ATTRIBUTE for some object classes,
ip.access had to extend it to be able to set attributes on arbitrary
objects. We now introduce a function implementing that message.
Supporting GPRS means we have a number of additional OML objects to
deal with. We need to extend our gsm_bts structure to at least
include the nm_state for each of those objects.
Tag-variableLength-Value is an encoding scheme used in the GPRS NS
and BSSGP protocols, where the length value can be 8 or 16 bits,
depending on actual demand.
For the compiler classmark1 is a struct and the compiler is
unaware that it fits into an unsigned int. Use memcpy to
copy it to a u_int8_t (the compiler should inline this).
dbi_conn_quote_binary_copy works on unsigned char* change
q_apdu to be unsigned char.
Commit 9bd7bc1b4c caused the RSL
initialization to happen too early, resulting in the BTS
bootstrapping but missing [some of?] the system information
types.
In order to support multi-TRX configurations, we need to be able
to cope with multiple RSL streams (each with their own stream identifier)
inside one ip.access TCP connection.
Since this is very similar to using the TEI on a E1 line, we simply
recycle the logic and data fields that are used for the TEI.
this fixes the delay of audio caused by stalling of the openbsc process.
the use of 'usleep(100000)' for slowing down transmission to nanoBTS is
replaced by the tx-delay timer. i did this on bs11 code, so i did it the
same way. it actually queues frames for transmission not nanoBTS. on
transmission a timer is started and when this timer expires, the next
frame in the queue is transmitted (timer restarted) until the queue is
empty.
Add support for 1900 nanoBTS by using unified bts_type
GSM_BTS_TYPE_NANOBTS for 900, 1800 and 1900 versions.
Reduce the nanoBTS enum values to one and derive the
version from the user supplied band. In the future we
might want to do auto band detection.
The configuration file needs to be changed to refer
to nanobts instead of nanobts900/nanobts1800.
Signed-off-by: Mike Haben <michael.haben@btinternet.com>
Signed-off-by: Holger Hans Peter Freyther <zecke@selfish.org>
Addresses a FIXME in abis_nm.c, parsing the parameters
passed by a Software Activate request. I've tested this
on three different IpAccess BTSs (including one which
didn't work with the original code), would be good if
someone could check it on a BS11.
Signed-off-by: Mike Haben <michael.haben@btinternet.com>
Tested-by: Holger Hans Peter Freyther <zecke@selfish.org>
We are using LAC=0 for remembering that a GSM subscriber is
detached. I recently added code to gsm_bts_by_lac that will
return every BTS in case the lac is 0. Harald highlightes
that we would now search for detached subscribers at every
BTS of our network which is clearly not what we want.
Introduce two defines for the two reserved LAC, add a
pointer to the specification, check that our config files
do not contain these reserved values, use the define
and change gsm_bts_by_lac to use the other define.
This is a regression coming from the recent split of the
handle_ts1_read method in two.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Signed-off-by: Holger Hans Peter Freyther <zecke@selfish.org>
For the MSC<->BSC connection we are going to use the same header
as used from BTS<->BSC but we are not having an E1-Link, a gsm network
or a gsm_bts available and can not use this part of the code.
The LAC can be 16bit of size. the generation of the LAI, struct
gsm_subsriber and the BSC<->MSC was already using it as a
16bit (short) value.
Change struct gsm_bts to parse 16bit and change the vty configuration
parsing code to deal with a short too.
For the on-waves.com MSC case we want to page every BTS reached
of the network. Our gsm_subscriber entry does not have a LAC
entry set and defaults to zero. Use the reserved 0x0000 to
indicate that we want to use every bts in the network.
This will influence the paging code to start and stop paging.
Add one method to extract the MI which will allow to load
the gsm_subscriber depending on the MSC/BSC setup and then
use gsm48_handle_paging_resp to finish the paging response
handling.
Gracefully handle a case where success and expire could fire... I'm
only hitting this when doing something evil to simulate network code
but it seems appropriate to handle this gracefully.
Transfering the cell_identity from BSC to MSC is required for the
on-waves.com support. Allow to set the cell_identity in the cfg
file and patch the system information tables to set it.
tmsi is four octets long, there is no need to make it a string
and then jump through hoops to convert it to a number. Keep the database
using it as a string to benefit from the NULL handling of the db.
Introduce the reserved tmsi which has all bits set to 1 according
to GSM 03.03 §2.4 and start checking for it and make sure the db
code will never allocate such a tmsi.
When only one SMS is sent, the freeing of the lchan will
automatically free all transactions on the lchan.
However, if there are several SMS sent at once, the call
to gsm411_send_sms_lchan will create a new transaction
with the same caracteristics as the previous one. If
the old one is not free'd, the next call to trans_find_by_id
(triggered by the next incoming RP-ACK) will not return the good
transaction and things go haywire.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The algorithm ID used in the GSM 04.08 RR message is
(x-1) for A5/x. In RSL it's (x+1) for A5/x so there is
a difference of 2.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This just adds the 04.08 and RSL bits for A5, but not the logic
for performing authentication.
The caller would first set lchan->encr and then call
gsm48_send_rr_ciph_mode(lchan), which encapsulates the 04.08
CIPHERING MODE COMMAND into a RSL ENCRYPTION COMMAND and sends it
to the BTS for execution + forwarding.
This fixes the 'only first call works' problem that some of us were
having with the nanoBTS.
(the field just happenned to be 0 == GSM48_CMODE_SIGN after startup)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Prefix generate_mid_from_tmsi with a gsm48_, create a new method
to binary encode the imsi. Add a unit test for parsing and decoding.
The implementation can parse the data it generated and the
last octet seems to be filled with the end mark.
Do not advertize to broadcast on a different frequency, this
was only useful for the HAR2009. The frequency list of the cell
probably needs to migrate into the vty config file.
Revert of ee4410a4f3
Share the initialization and bootstraping of the network by moving
the code to a new file and making boostrap_network and shutdown_net
external.
Cleanup the header list after the move and remove trailing whitespace.
The existing gsm_04_08.c implementation is mixing BSC and MSC
behavior. Move some simple parsing and generation functions over
to gsm_04_08_utils.c to allow a different MSC to define the policy.
Currently we have circular dependencies from libbsc to libmsc
and this requires to play some linker tricks. The problem will
be solved in two ways, first we will get rid of the circular
dependencies and second we can start using --start-group and
--end-group of the linker to play the tricks for us.
For the BSC part we still assign a gsm_subscriber to lchan but it
might only contain the TMSI of this subscriber.
For the MSC part we will need the HLR/VLR feature of the gsm_subscriber,
specially the lookup's by number...
So if libbsc.a/libmsc.a are compiled in one app and used the
subscribers will be shared, and if only libbsc.a gets used we will
have more empty gsm_subscriber.c..
Attempt to split up bsc/msc functionality according to the specs. The
libbsc.a will be responsible for communicating with the BTS, configuring
it, paging, channel allocation and passing layer3 messages in both
ways. libmsc.a will implement the policy and such.
this enables the caller to detect if the paging request was rejected
by the paging layer, especially in case it is already paging this very
subscriber.
In the case of SMS / 04.11, we used to have a memory leak of struct gsm_sms's,
since we would only free them from the paging succeeded/expired callbacks.
the various constructors get called in a non-obvious, linker determined
order, which makes certain objects disappear from the talloc report.
This change moves the talloc context creation into a new talloc_ctx.c file
SMS related messages are all sent over SAPI=3. But in addition
to that, we also need to send it over the correct link identifier,
i.e. SACCH or main signalling channel
Harald Welte
Steffen Neubauer
Sylvain Munaut