Do not directly send data from inside the mgcp_protocol.c
implementation. Instead allocate and return a struct msgb*. The
caller can then either wrap that into the IPA protcol or directly
send it over the UDP socket.
* Call a callback when the endpoint was created, modified or deleted. This
can be used by the BSC MUX to send a MGCP packet over TCP to the right
the BSC to allocate the endpoint there with the right data, or it can be
used in the BSC to send the right commands to the BTS.
* Separate main process and protocol handling into two parts.
* Change the protocol handling to work with UDP and TCP connection
* This will allow to speak MGCP over TCP between the BSC MUX and
the real BSC.
In plain forward mode we don't have DLCX which will clean
and reset the configuration. We will need to remember the
last GSM BTS port and send data to it.
* Do not only check the IP but also the port to figure out
where to send the data
* Do not memset the endp->remote inside the bind_rtp but from
inside the crcx as this will be modified by the MDCX
Rename the variables to refer to the fact that they are
the ports of the remote.
So we have:
rtp_port as the local address we are binding to
net_rtp for the network rtp
bsc_rtp for the bsc rtp
I want to reuse the SCCP code for header parsing in the BSC
NAT to identify data and patch the source local reference. To do
this the current handle_* methods will be changed into two parts
one is strictly parsing the other is handling the parsed data.
If the lchan has AMR as speech codec we also need to send the
multirate config IE in the channel activation. This is already
done for the RSL Channel Modify message.
the unix select function returns a set of file descriptors to be
handled. the result-loop (the loop after the select()) is called again,
if more than one descriptor is removed by the callback funtion. this may
lead to a another call to the callback function, because the bits of the
FD_SETs do not change and still set.
i think we must clear these bits, if they are handled, so the handler
will not be called twice in case of a "restart" of that loop.
The way the VTY configuration sytem works is that it first registers a
BTS of type GSM_BTS_TYPE_UNKNOWN and then sets the type correctly (after
encountering the type statement). This makes sure that registering a BTS
of type UNKNOWN succeeds.
In 39315c4798 we introduced
per-bts OML attribute parser definitions and disallowed
a BTS of type unknown.
However, the VTY code first allocates a BTS with unknown type.
With forward IP in the config and early bind on we will
simply forward RTP data on the endpoints from BTS to the
forward IP address.
This is implemented by disabling MGCP functionality when
a forward IP address was specified, setting the forward IP
in the endp->remote and assigning a ci != CI_UNUSED.
Early bind will make sure the sockets are created, the BSC FD's
are registered and then the normal dispatch code will
do the forwarding.
Some NM attributes are defined differently depending on
the BTS type. Having one big nm_att_tlvdef[] table for
all BTS types is no longer sufficient. This patch
* introduces 'struct gsm_bts_model' to describe a BTS model
* adds definitions of gsm_bts_model for BS-11 and nanoBTS
* changes the abis_nm_tlv_parse() function: include a bts pointer
Currently starting with the opencfg.cfg.nanobts and writing it out
and then trying to start again will not work. The network reject_cause
is initialized to 0 which is not a valid reject reason and when writing
this to the config file and trying to parse it will fail.
Pick roaming not allowed as a harmless option to those phones
accidently trying to connect to the BTS.
These commands let you change the PLL set and work values. Many thanks
to Dieter Spaar for figuring out how to do this!
Now you can just reset your PLL work value if it drifts away due to your
E1 card.
Use it like this: bs11_config pll-workvalue 1000
Whether this function changes the set or the work value depends on your
type of login. In FACTORY login it changes the set value, in FIELD login
it changes the work value (which is what is used by the BS11 to tune the
frequency).
This is useful information to know and actually fixes a segfault
in rllp.c where lchan is accessed even tough it could be NULL in
case of failure.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
At least some nanoBTS 139 send the last even (going online) as
'enabled' 'unlocked' but no avail status IE (which I guess mean an empty
set, the doc 12.21 isn't that clear about that).
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Follow up on 424c4f0e29. As pointed out
by Sylvain on the mailinglist I need to remove this here as well.
Do not call db.c code from code that is located in libbsc.a
vty_interface.c is part of libbsc.a but it started to use code
which is found in db.c recently. Fork the subscriber dumping and
provide more information on the layer3+ (MSC) commands. This
is restoring the separation again.
Theses will be useful to know if we can reuse the tuples or if
we should renew. The 'issued' is currently purely informative.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This returns true if the gsm_nm_state can be considered 'running'.
Note that we also accept availability==0xff (which is a code for
no value) because according to 12.21 it is perfectly valid.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The exact sequence the states the BTS goes through is slightly
different for one of the nanoBTS 139 I have and it needs this
to start.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Thise two functions are interfacing with the 04.08 layer 3 to
determine if a particular message should be handled inside
the OpenBSC layer 3, or if it should be handled in the silent call
handler.
* On start the vty code will call the abis_nm method and this
will set the administrative state to unlock/lock
* During startup the BTS will report its state as well and would
possible overwrite the set administrative. We are only going
to update the administrative if it was 0 before. This appears
to work on all of my tests. In case this will not be the case
for others we will have to split the administrative into two
sets one for the BTS and one for the BSC.
* This is used in sw_load_init and sw_load_end and both needs
to be touche for every BTS. Move it into a common method.
* This was only verified on the nanoBTS.
* Do not issue the restart right aways if we have OML IP or
software load in the queue (hint, we need a real queue of operations
to carry out... with one big state machine)
* Change the signal_data of ipacc ACK/NACK to contain the msg type
and the bts pointer.
* Issue a restart for software load and OML and use the BTS pointer
we got out of the new signal data.
We are filling sw_load1 with the information found with type
0x1000 and sw_load2 with type 0x2001. It appears from the protocol
traces that these information is not extracted from them. We also
need to include the \0 from the string.
With this firmware flashing seems to work.
* text3 seems to be a version as the text content starts
with a 'v'
* move the sdp_firmware into the ipaccess.h and declare
the function. The headers are returned through a list.
* The second magic number is only a short and it is
the same for all of my cases
* This also means that the first and second header
are the same which means the unknown 8 byte are
header and file size... and the 122 bytes are
actually multiple strings (just all empty on the
outermost SDP). Adding the strings left us with 120
bytes so we have two bytes of unknown usage..
* This is now capable of parsing outer and inner SDP
files and print their header.
* The internal SDP appears to have a different magic number
than the first entry and a slightly different packet format
* There are 8 byte of binary for at the beginning and the header
ends with a table pointing to some strings and then the actual
firmware follows.
* We currently only parse the strings of that header.
The something3 points to the next start of the SDP
entry. The four bytes in front of the " SDP" are not
known and just discarded. Prepare to be able to
recursively parse the SDP header...
I must have picked in the wrong section of these
files... There are some kind of header entries
that are all 138 byte long and this is the total
length...
In many cases we actually want a name / unique ID for the lchan,
not just for the on-air timeslot... especially in SDCCH/8 case,
where 8 SDCCHs share one timeslot...
When we allocate a channel, we send the RSL CHAN ACT REQ and wait until we get
a CHAN ACT ACK. Only the ACK will change the state, so there is a race where
we allocate that same channel to a different channel request before we get
the ACT ACK.
Introducing a new ACT_REQ state resolves this issue.
When we have received the End Ack we are just doing nothing as we
are done. This means rc remains -1 and we will print a warning but
there is no need to have a warning...
* The FOM header needs to be different. We need to address the
base station transceiver, bts, trx set to 0 and ts to 255
* We need to transfer the the \0 of 'id' and 'version'
* We need to issue a NM_ATT_SW_DESCR (just the value)
* We need to use 16bit length for the other two ids..
* After this our Software Load Init is getting an Ack.
Strictly speaking we would only need to start the Site Manager
and could probably start flashing afterwards but it is more easy
to have one config path...
This will mostly work like the downloading in bs11_config
and is based on the bs11_config state machine as well. Once
it is working we can see how to unite both implementations.
See GSM 04.11 Chapter 5.4 for details. The idea is that when
multi-SMS are mobile originated, it's possible the CP-ACK of
the previous transaction to be lost and the reception of a
new CP-DATA for a new transaction should close previous transaction
"as-if" we had received the CP-ACK ...
Note that testing is hard since it's an exceptional condition that's
hard to create. I tested by temporarly disabling CP-ACK processing
and checked it worked as expected.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Holger Hans Peter Freyther
Harald Welte
Sylvain Munaut