These commands let you change the PLL set and work values. Many thanks
to Dieter Spaar for figuring out how to do this!
Now you can just reset your PLL work value if it drifts away due to your
E1 card.
Use it like this: bs11_config pll-workvalue 1000
Whether this function changes the set or the work value depends on your
type of login. In FACTORY login it changes the set value, in FIELD login
it changes the work value (which is what is used by the BS11 to tune the
frequency).
This is useful information to know and actually fixes a segfault
in rllp.c where lchan is accessed even tough it could be NULL in
case of failure.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
At least some nanoBTS 139 send the last even (going online) as
'enabled' 'unlocked' but no avail status IE (which I guess mean an empty
set, the doc 12.21 isn't that clear about that).
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Follow up on 424c4f0e29. As pointed out
by Sylvain on the mailinglist I need to remove this here as well.
Do not call db.c code from code that is located in libbsc.a
vty_interface.c is part of libbsc.a but it started to use code
which is found in db.c recently. Fork the subscriber dumping and
provide more information on the layer3+ (MSC) commands. This
is restoring the separation again.
Theses will be useful to know if we can reuse the tuples or if
we should renew. The 'issued' is currently purely informative.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This returns true if the gsm_nm_state can be considered 'running'.
Note that we also accept availability==0xff (which is a code for
no value) because according to 12.21 it is perfectly valid.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The exact sequence the states the BTS goes through is slightly
different for one of the nanoBTS 139 I have and it needs this
to start.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Thise two functions are interfacing with the 04.08 layer 3 to
determine if a particular message should be handled inside
the OpenBSC layer 3, or if it should be handled in the silent call
handler.
* On start the vty code will call the abis_nm method and this
will set the administrative state to unlock/lock
* During startup the BTS will report its state as well and would
possible overwrite the set administrative. We are only going
to update the administrative if it was 0 before. This appears
to work on all of my tests. In case this will not be the case
for others we will have to split the administrative into two
sets one for the BTS and one for the BSC.
* This is used in sw_load_init and sw_load_end and both needs
to be touche for every BTS. Move it into a common method.
* This was only verified on the nanoBTS.
* Do not issue the restart right aways if we have OML IP or
software load in the queue (hint, we need a real queue of operations
to carry out... with one big state machine)
* Change the signal_data of ipacc ACK/NACK to contain the msg type
and the bts pointer.
* Issue a restart for software load and OML and use the BTS pointer
we got out of the new signal data.
We are filling sw_load1 with the information found with type
0x1000 and sw_load2 with type 0x2001. It appears from the protocol
traces that these information is not extracted from them. We also
need to include the \0 from the string.
With this firmware flashing seems to work.
* text3 seems to be a version as the text content starts
with a 'v'
* move the sdp_firmware into the ipaccess.h and declare
the function. The headers are returned through a list.
* The second magic number is only a short and it is
the same for all of my cases
* This also means that the first and second header
are the same which means the unknown 8 byte are
header and file size... and the 122 bytes are
actually multiple strings (just all empty on the
outermost SDP). Adding the strings left us with 120
bytes so we have two bytes of unknown usage..
* This is now capable of parsing outer and inner SDP
files and print their header.
* The internal SDP appears to have a different magic number
than the first entry and a slightly different packet format
* There are 8 byte of binary for at the beginning and the header
ends with a table pointing to some strings and then the actual
firmware follows.
* We currently only parse the strings of that header.
The something3 points to the next start of the SDP
entry. The four bytes in front of the " SDP" are not
known and just discarded. Prepare to be able to
recursively parse the SDP header...
I must have picked in the wrong section of these
files... There are some kind of header entries
that are all 138 byte long and this is the total
length...
In many cases we actually want a name / unique ID for the lchan,
not just for the on-air timeslot... especially in SDCCH/8 case,
where 8 SDCCHs share one timeslot...
When we allocate a channel, we send the RSL CHAN ACT REQ and wait until we get
a CHAN ACT ACK. Only the ACK will change the state, so there is a race where
we allocate that same channel to a different channel request before we get
the ACT ACK.
Introducing a new ACT_REQ state resolves this issue.
When we have received the End Ack we are just doing nothing as we
are done. This means rc remains -1 and we will print a warning but
there is no need to have a warning...
* The FOM header needs to be different. We need to address the
base station transceiver, bts, trx set to 0 and ts to 255
* We need to transfer the the \0 of 'id' and 'version'
* We need to issue a NM_ATT_SW_DESCR (just the value)
* We need to use 16bit length for the other two ids..
* After this our Software Load Init is getting an Ack.
Strictly speaking we would only need to start the Site Manager
and could probably start flashing afterwards but it is more easy
to have one config path...
This will mostly work like the downloading in bs11_config
and is based on the bs11_config state machine as well. Once
it is working we can see how to unite both implementations.
See GSM 04.11 Chapter 5.4 for details. The idea is that when
multi-SMS are mobile originated, it's possible the CP-ACK of
the previous transaction to be lost and the reception of a
new CP-DATA for a new transaction should close previous transaction
"as-if" we had received the CP-ACK ...
Note that testing is hard since it's an exceptional condition that's
hard to create. I tested by temporarly disabling CP-ACK processing
and checked it worked as expected.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The current code used the variable bitmap format, but
that's not possible since in this format the base ARFCN is
part of the set. That lead to a neighbor list containing ARFCN 0.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
We need transaction_id to be a int (as returned by trans_assign_trans_id)
to detect the error condition -1.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The idea is to find the highest used id and try to get the
next. This way when there are transactions back to back with
an overlap, we go 0 1 2 3 4 5 6 0 1 2 ...
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This marks the departure from printing all the debug messages to the console by
default. We only print NOTICE and WARNING level messages by default
If you're interested in more details, you need to enable it via command
line options or the VTY
The VTY code makes so many allocations that a full report is
simply too long to provide any useful information. So we sub-divide
it in multiple contexts, and report only one level deep at SIGURS1.
We also introduce SIGUSR2 for the full detailed VTY report.
In case we have multiple TRX configured, but not all of them are
actually active/operational, we should not try to allocate channels
from such transceivers.
This proxy allows us to restart OpenBSC while the BTS's are kept
running with their CCCH/BCCH alive. This is very useful to
make sure the phones don't roam to other networks while restarting
OpenBSC.
The proxy also intrduces UDP sockets for injecting UDP packets
into the A-bis data stream.
So far I have not much idea about the format. It is starting with
the magic byte and the header is spanning until the next occurence
of the " SDP" marker.
The magic " SDP" is occuring twice in the file. The first time
seems to be the file header and the second time it is with the
payload. We will need to parse this somehow...
* The two version strings are not in an easy to parse header
and from my trace it appears like the whole file is sent
to the BTS. So just open the firmware file..
Change the counters_store_db function to be a generic for_each
function taking a function pointer and data. Use that in bsc_hack
to store it to the DB.
This is removing the DB requirement and will allow to handle
the counter values in different ways without making the counter
list public.
I verified that the syncing is still taking place.
This is the new logging architecture, including
* support for multiuple logging targets like stderr and vty
* log levels in addition to categories/subsystems
* filtering based on imsi, i.e. only see events for one subscriber
* dynamically change log level for each category for each vty
This has the advantage that counters can be added all over the code
very easily, while having only one routine that stores all of the
current counter values to the database. The counters are synced
every 60 seconds, providing relatively fine grained statistics
about the network usage as time passes by.
Tweaking theses can be useful especially tx-integer that influence
both the spread of rach attemps and the delay between two attemps.
Looking up GSM 04.08 3.3.1.1.2 & 10.5.2.29 can help determine good
values. The default are choosed with a wide spacing between attemps
(tx integer = 9 -> T=12 & S=217 (non-combined CCCH/SDCCH) or 115 (for
combined CCCH/SDCCH)). This alleviates the problem of responding to
several RACH attempts by a same MS, allocating several RF channels when
only 1 is needed.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The previous implementation had some shortcomings:
- If the MIN ID given was not the exact id of the first unsent SMS,
it would try to submit the same sms several time until id++ finally
made id go to the next one.
- If a subscriber had several SMS pending it would try to submit
them individually (only to get rejected because a paging for that
subscriber was already in progress)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
we need to set newbfd->priv_nr to 2+trx_id, rather than keeping
it '2' all the time, as it is used to look-up the e1i_ts when
we receive a packet. A constant '2' would always match to TRX 0.
we also need to keep one separate bit for each TRX state in order
to properly generate the EVT_E1_TEI_UP event for trx > 0.
This implements the handover algorithm (and associated parameters)
as described in Chapter 8 of the book "Performance Enhancements in
a Frequency |Hopping GSM Network" by Thomas Toftegard Nielsen and Jeroen
Wigard.
The parameters such as averaging windows are configured in struct
gsm_network. We keep some state to trakc up to 10 neighbors as
they are being reported from the MS.
This has so far only been tested in a network with two BTS that
have each other as neighbor. Networks with morge neighbors might
encounter bugs.
This allows us to block packets that we have received after the channel
is no longer being used. This is visible during handover, where we still
receive a measurement report after the MS has switched to the new channel.
This leftover measurement report then attempts to trigger another handover,
which si bogus and will fail - and thus only consumes resources.
With the new LCHAN_S_ACTIVE state, we can check for this when processing
the measurement report.
This provides two functions: get_meas_rep_avg() to obtain the sliding
window average of one particular field, and meas_rep_n_out_of_m_be()
to check if at least N out of M measurments are >= BE.
If a RF channel is assigned but no response is ever heard from
the phone, we will receive a CONNECTION FAIL from the BTS,
triggering a RF release freeing the channel. Then sometime later,
T3101 will expire as well and free the channel again ...
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
- Need to use sms.id for the ORDER BY since 'subscriber' also has 'id'
- Need to add the join clause between 'SMS' and 'subscriber'
- Add a LIMIT 1 (probably no impact for the db size we're dealing with
here, but with large DB and mysql/postgresql this can help the planner)
- (fix a wrong comment in passing ...)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
This patch takes care of handling the RTP streams / sockets during
an in-call handover from one BTS to another BTS.
It only works in combination with rtp_proxy mode.
This is not really nice, but we will soon have multiple users of
the CRCX / MDCX / DLCX signals, and we cannot guarantee the ordering
of them. So as a workaround, we move the RTP socket creation and
deletion into the core abis_rsl codebase.
We cannot support in-call handover of calls without a RTP proxy,
since at the time of the handover the SSRC, sequence number and
timestamp of the RTP frames change.
Since the MNCC API can now send and receive frames to/from the MNCC
application, we can also implement a proxy this way. Not at the RTP/UDP packet
level, but at the 'TCH speech frame' level.
Especially for handover, we need this mode as the receiver in the BTS needs a
persistent SSRC and monotonic frame numbers / timestamps.
During handover, we will not send RTP frames for quite some time. However,
the way the rtp_send code is structured, it will increment the timestamp
with a fixed amount every time we send a frame, independent how much wallclock
time has actually passed.
This code is a hack to update the sequence number and timestamp in case it
seems to be wrong. It makes handover much more reliable.
Holger Hans Peter Freyther
Sylvain Munaut
Harald Welte