Commit Graph

2146 Commits

Author SHA1 Message Date
Pau Espin ba5683194a Add counter for successful contention resolution procedures
This counter is related to succPDTCHSeizures,
(3GPP TS 52.402 B.2.1.51 Successful PDTCH seizures).

The relevant event when the first RLC block on the PDCH from the MS is
received is the fact that contention resolution is considered as done in
the network side. Hence, name the counter that way to ease

Related: SYS#4878
Change-Id: I3d67e3e68907921b43f2ca4398ad9578c0b2618c
2021-11-08 18:33:04 +00:00
Pau Espin cc77eed9d9 tbf_ul: Improve documentation of tbf_alloc_ul_pacch()
Change-Id: I59493788b4a54610a70f3eb4c31fd05f6e39e63d
2021-11-08 18:33:04 +00:00
Pau Espin 10b29153b7 pdch::rcv_resource_request(): Use local var to store bts pointer
Change-Id: Ica727c4b70cecc0ddb5d2a235bfc416735754b61
2021-11-08 18:33:04 +00:00
Pau Espin f61acd75c4 cosmetic: Add parenthesis around expression to clarify it
Change-Id: I621ef02868aff2bd23d82c8bc70e5cdbc391fbc2
2021-11-08 16:34:17 +01:00
Pau Espin dbd3b78a9b tbf_ul: Update FSM names for dummy reject TBFs
This allows easily identifying dummt TBFs created to send assignment

Change-Id: I73a197795a9c8e9cd8dc06bf46ddb8f275d2c289
2021-11-08 16:33:51 +01:00
Pau Espin dff399fa42 bts: Add counters for successful 1,2 phase pkt access
These counters relate to succPDTCHAssProcsPerCause
(B.2.1.50 Successful Packet Channel Assignment Procedures, per cause).

Related: SYS#4878
Change-Id: I494afab337f2557ffa38e4c7ff2c15a1647a1e04
2021-11-08 15:26:49 +00:00
Pau Espin a02f945479 tbf: Set tfi to initial special value
This allows distinguishing when a TBF didn't set the TFI. Useful to
identify dummy reject TBFs, etc, and make sure a non-dummy TBF set its
TFI properly.

Change-Id: Iecf54a24041bd14f4ef5b86e57c3732e1b69d463
2021-11-08 13:24:20 +01:00
Pau Espin d3d46de278 tbf: Mark initial first_(common_)ts with special value
This way it's easier to distinguish when this value was not properly
filled when debugging or looking at logs.

Change-Id: I0c9c9fdcfca9eb15125ea49efcbb76711850052e
2021-11-08 13:24:20 +01:00
Pau Espin de0eeafd2e tbf: Set m_created_ts in constructor
This way the timestamp is also set for dummy reject TBFs. For other
TBFs, setup() is called immediatelly after calling the constructor, so
we are fine too.

Change-Id: I2966ec7f3f9161d528a173d94797b72d1398c747
2021-11-08 13:24:20 +01:00
Pau Espin 063296883f tbf_ul: Set first_(common_)ts in handle_tbf_reject
Let's set them to match expectancies for this type of dummy TBFs, in
order to avoid acidental use/access of other timeslots to the one where
the reject was associated to.

Also use tbf_assign_control_ts() to log the TS used for the TBF, similar
to what's used in other places where control_ts is assigned.

Related: OS#5293
Change-Id: I32dcb29ad24519082b8665921efcce0b5a16d12e
2021-11-08 13:24:20 +01:00
Pau Espin 92cbe4aee0 pdch: Improve log line and increase log level
Change-Id: Ie593331a69f6b8ec3b21e2b274a1aa060b2dc439
2021-11-08 13:24:19 +01:00
Pau Espin b6babc39dc tbf: Increase log level of line about unable to allocate poll for TBF
Change-Id: I0bd972d3b68017f12a0816a27162e3a409b1893a
2021-11-08 13:24:19 +01:00
Pau Espin 48df600bfa bts: Count RACH Request with unexpected content
Change-Id: I86420b08a9a634ca2e1f5a1c7e66ec3d3c08ce0b
2021-11-08 12:23:31 +00:00
Pau Espin 812a7d3fa3 bts: Improve logging to clarify RACH req is for 2 phase access
Change-Id: I047b688197a07e3592f19888f0ca71b9c3d2b3fd
2021-11-08 12:23:31 +00:00
Pau Espin 769e28114f bts: Introduce new RACH req counters for one/two phase access
These new counters allow the user to find out which kind of access are
MS requesting.

Related: SYS#4878
Change-Id: Id87c3a53d3acee92499987c843130e358f54742c
2021-11-08 12:23:31 +00:00
Pau Espin bf129c1437 vty: show tbf: Drop unneeded check for non-null ms
Since a while a go, a TBF is guaranteed to always have a MS assigned.
Hence, there's no point in checking it.

Change-Id: I89e062432ac671c73731ce68c889aeb5e24277f5
2021-11-05 20:46:08 +01:00
Pau Espin 14015124ed vty: Log tbf_state when showing a TBF
That's one of the most important information bits about a TBF when
debugging, and it's not shown currently, only when "show ms" is used.

Change-Id: I98e3c9cac4ca6fc29695768ecc6e0444e618b945
2021-11-05 20:44:49 +01:00
Pau Espin 43fc4a8690 vty: Avoid crash in tbf_print_vty_info with null ptr ctrg
Previous code did use a ctrg based on MS being EGPRS capable or not.
However, an MS being EGPRS capable doesn't mean necessarily that all its
TBFs are EGPRS, since we may known about the capability after we already
created some previous TBF, so it was not ugpraded. Hence, we were
sometimes accessing the wrong NULL ctrg.
Let's simply check for non NULL ctrg when deciding what to print.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7561ea6 in vty_out_rate_ctr_group (vty=vty@entry=0x897850, prefix=prefix@entry=0x4482cd " ", ctrg=0x0) at utils.c:82
82    utils.c: No such file or directory.
(gdb) bt
 #0  0x00007ffff7561ea6 in vty_out_rate_ctr_group (vty=vty@entry=0x897850, prefix=prefix@entry=0x4482cd " ", ctrg=0x0) at utils.c:82
 #1  0x000000000041437b in tbf_print_vty_info (vty=vty@entry=0x897850, tbf=0x3fb61f0) at pcu_vty_functions.cpp:98
 #2  0x0000000000414acc in pcu_vty_show_tbf_all (vty=vty@entry=0x897850, bts=bts@entry=0x7be650, flags=4294967295) at pcu_vty_functions.cpp:127
 #3  0x000000000041206f in show_tbf (self=<optimized out>, vty=0x897850, argc=<optimized out>, argv=0x7fffffffe040) at pcu_vty.c:1150
 #4  0x00007ffff755d167 in cmd_execute_command_real (vline=vline@entry=0x7bc300, vty=vty@entry=0x897850, cmd=<optimized out>) at command.c:2604

Related: SYS#5689
Change-Id: I3979bfc12dd3b9a53b34b284537f271c356a3024
2021-11-05 20:44:39 +01:00
Pau Espin 7ce56d7c64 bts: Rename 11bit RACH request counter
This way it fits better the structure where the general one counts all
rachs, and 11bit only the 11 bits. More per-type splitting will be done
in follow-up commits where new types are added.

Change-Id: Ibdfb10dcc65d71e98e2fe8b05001cafea786f071
2021-11-02 16:47:08 +01:00
Pau Espin 858f038c1c tbf_ul: Document context where tbf_alloc_ul_ccch() is used
It can be seen that this function properly passes single=true to

Change-Id: Id83bfd78c88fa9e4fa98268cc726298c276e6f20
2021-11-02 16:45:42 +01:00
Pau Espin 7e8d5ab4c4 bts: Fix misleading log line in bts_rcv_rach()
If it's not single block packets access, then it's one phase packet
access. TS 44.018 Table
One phase packet access with request for single timeslot uplink transmission;
one PDCH is needed.

Change-Id: Ic6beb6dcfebb77fd264b179b028f99a29c644fb1
2021-11-02 14:08:15 +01:00
Daniel Willmann dd28f82747 gprs_bssgp_pcu: Fix crash when configuring an existing ns bind
ns_configure_nse() only sets bind when it doesn't exist yet. If it
already exists bind[i] stays NULL and causes a segfault in
gprs_ns2_is_ip_bind() later on.
This patch ensures bind[i] is either created of set to the existing

Change-Id: I103e82e6c64324c087a4ff325a83eeab0e5a4ee9
Related: SYS#4971
2021-10-29 17:34:24 +02:00
Pau Espin 9ecdc11eb6 csn1_dec.c: Fix stored bit in CSN_NEXT_EXIST_LH
Fixup for previous patch, which forgot to update the pui using the new
variable, as done already in the same patch for M_NEXT_EXIST.

Change-Id: I92a04c708bcc6c15348324321e8890361bbc5c31
Fixes: 72cdb30ee2b1c0d71ff6d9583d51f46b2e5fdcea
2021-10-20 17:21:34 +02:00
Pau Espin 1859ec38cc csn1: Avoid storing existence bit as true if content was actually NULL
If we decode Exist bit as "1" but we are at the end of the message, and
all the Next items we'd read are expected to be possibly NULL, then swap
the Exist bit in the decoded structure as "0" in order to tell the
decoder user that the related information structure is actually unset,
as if "0" was received.

Related: SYS#5552
Related: OS#4955
Related: OS#5020
Change-Id: I38602e4b680ed87297c7e440691a494c07cad446
2021-10-20 15:36:01 +02:00
Pau Espin ebdc0d8c17 csn1: Avoid failing if optional DownlinkDualCarrierCapability_r7 is missing
All additional release fields are considered optional, and the
CSN_DESCR for Content_t already marks almost all as such, except

It has been found that some MS transmits a MS RA Capability with a Length=61 bits
where the last bit in the buffer is setting the Exist bit for
DownlinkDualCarrierCapability_r7 as 1. Hence, the CSN1 decoder failed to
decode the whole message because it expected to keep reading there
despite there's no more bytes to read.

While this is could actually be considered an MS bug, let's relax our
expectancies and simply consider the case { 1 <end> } as it was { 0 },
and mark skip decoding DownlinkDualCarrierCapability_r7. That waht
wireshark (packet-gsm_a_gsm.c) or pycrate do for instance.

This patch itself doesn't fix the problem where actually the Exist bit
is stored as 1 in the output decoded structure, but simply allows keep
ongoing with decoding until the end. This issue will be fixed in a
follow-up patch.

Related: SYS#5552
Related: OS#4955
Related: OS#5020
Change-Id: I9a2541bd3544802a646890f32725201836abb0da
2021-10-20 15:36:01 +02:00
Pau Espin 089d734cd1 csn1: Add unit test showing RadioAccess Capability decoding failure
This RA Cap creaes a decoding error on our CSN1 decoder, but seems to be
handled properly by wireshark's own decoder as well as pycrate.

The ending bit of last byte in "MS RA capability 1" has a "1" which
according to spec should flag the existance of
DownlinkDualCarrierCapability_r7, but nothing else comes after it. This
matches the expectancies as per Length field of the first RA Cap.

Related: SYS#5552
Related: OS#4955
Related: OS#5020
Change-Id: I51235e8575f4b992b44078713ec67bbccfd13293
2021-10-20 15:36:01 +02:00
Pau Espin c90e6f8de1 Split csn1.c into common, enc and dec files
The CSN1 encoder/decoder code is already lengthy and complex enough,
there's no need to keep it in the same file, specially because when
debugging, only is interested in one of the 2 functions, and they both
look really similar (long spaghetti switches).

Change-Id: I7d1b1f7e6d7f89b052b3fd73a960419bb2673020
2021-10-20 13:35:44 +00:00
Pau Espin fef3da24ae pcuif: Submit data_req with len=0 as idle frames
This way PCU always answers DATA.ind and the BTS can still clearly
identify idle frames. It also simplifies testing and verification of
correct behavior.

Related: SYS#4919
Change-Id: Ife718eeed2af011479c03099ea109518f04567bc
2021-10-20 13:35:10 +00:00
Pau Espin 9f43c65c99 cosmetic: Fix typo in comment
Change-Id: I9e6d0963533e15e73fb51bed11af563a62b92ecb
2021-10-19 14:20:11 +02:00
Pau Espin affd6a7f7a tbf: Drop unneeded braces in one line condition
Change-Id: Ief5e0ea0b7146d3330a17d5f0d171755b576fca3
2021-10-18 16:44:19 +02:00
Pau Espin e50b5f1e3f tbf: update(): return negative val on error
Let's follow usual convention where errors are returned as negative

Change-Id: Ib4f4dc37ae82ba8efdc212ed85af7934e16a8a8d
2021-10-18 16:13:51 +02:00
Pau Espin 8a9eec345e tbf: Assert if update() is called on UL TBF
This function is expected to be used only on DL TBF so far, so let's
really assert to avoid going through if something is wrong and ending up
later with other issues.

Change-Id: If398ee48364fce5b5e38830b2b278b3bad9a48a2
2021-10-18 16:11:34 +02:00
Pau Espin 89a995a439 tbf_fsm: Add assert verifying X2002 only triggers for DL TBF
Code above setting the timer in same tbf_fsm already has this kind of
assert, but it helps understanding the code having this assert here.

Change-Id: I7588deef5073694eb5fecdb516c241a04594e2b0
2021-10-18 15:36:58 +02:00
Pau Espin a2ef802dba tbf: Update FSM names when TFI change during tbf_update()
In that function, previous PDCHs are unlinked and then alloc_algorithm
is expected to assign new TFIs.

Change-Id: I7bcbb223ca32400bede7ab638695ba3c015c9946
2021-10-18 15:36:58 +02:00
Pau Espin 77e2ff32d9 ts_alloc: Rename s/tbf_/tbf/
Off the top of my head: The tbf_ was kept during a previous refactoring
a while ago to avoid changing lots of more lines in the same patch.

Change-Id: I8ae689a272b7c4d244576ff157f6019a87041abc
2021-10-18 15:36:45 +02:00
Pau Espin 9c84c88259 Get rid of tbf tsc field
TSC is not really a property of a TBF, so let's drop it in order to avoid
confusing and possible misuse of that accessor.

Change-Id: I105eb65d507e45631faddb23420c42bc9560e580
2021-10-18 15:35:51 +02:00
Pau Espin f5cb4acb14 bts_rcv_rach(): Split code paths for Ass and Ass Rej
The function becomes a bit more long but it's a lot easier to follow.

Change-Id: I80e554315d36a515a7edc9ae51057ce31eb9110d
2021-10-18 13:33:15 +02:00
Pau Espin 9b9f5efb09 bts_rcv_rach(): Gather pointers to data objects early and use them later
Change-Id: I476814d0f7be4b53f66211bb472700fee4f2caa9
2021-10-18 13:20:32 +02:00
Pau Espin 196f36b75a pdch: Log reason of expected POLL when receiving unexpected UL data
Change-Id: I914e38154029f57cbf38120495220cd860877c45
2021-10-18 12:37:51 +02:00
Pau Espin 592239630b pdch: Simplify code path allocating UL TBF
There's no real need to pass a tlli per separate, the information is
already contained in the MS. Furthermore, when doing so, it becomes
clear the TLLI was only passed to set it again on the MS, so actually
that ms_update() can be totally dropped since it will act as a no-op.

Change-Id: Ie761c3c7c222458ab0514117ae637ad3267139a0
2021-10-18 12:24:42 +02:00
Pau Espin b0aba59143 tbf: Drop pending polls during free also on states != ASSIGN
The situation holds true as long as the assignment is resolved. Hence,
it can also happen that the TBF is in RELEASE state, because it was
unable to do the assignment (and after retrying, MAX_N3105 moved it into
Let's not explicitly check states, the other conditions should be

Related: SYS#5647
Change-Id: I05fb0ea44aeb3fbda9e8e1c449e9366efaa2c511
2021-10-14 19:31:18 +02:00
Pau Espin b3291bc0e3 Abort scheduling of pending Pkt Ul Ass if tbf goes into RELEASE step
Change-Id: I20bab79070274b1d8f6b4e1867b30de61983ab54
2021-10-14 19:31:18 +02:00
Pau Espin 880cbd3a8f tbf_ul_ass_fsm: Avoid retrying Pkt Ul Ass if tbf is not in state ASSIGN
It doesn't make sense to keep asking the scheduler to retransmit Pkt Ul
Ass if the tbf_fsm already decided we are going to release the TBF.

It can be seen in following log extract:
tbf_ul_ass_fsm.c:112 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=ASSIGN EGPRS) start Packet Uplink Assignment (PACCH)
tbf_ul_ass_fsm.c:131 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=ASSIGN EGPRS) Scheduled UL Assignment polling on PACCH (FN=612941, TS=7)
tbf_ul_ass_fsm.c:188 UL_ASS_TBF(UL-TFI_1)[849e50]{SEND_ASS}: state_chg to WAIT_ACK
pdch_ul_controller.c:330 PDCH(bts=0,trx=1,ts=7) Timeout for registered POLL (FN=612937, reason=DL_ASS): TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=ASSIGN EGPRS)
tbf.cpp:550 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=ASSIGN EGPRS) poll timeout for FN=612937, TS=7 (curr FN 612937)
tbf.cpp:392 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=ASSIGN EGPRS) N3105 exceeded MAX (8)
tbf.cpp:602 TBF(UL-TFI_1)[7bd530]{ASSIGN}: Received Event MAX_N3105
tbf_fsm.c:194 TBF(UL-TFI_1)[7bd530]{ASSIGN}: state_chg to RELEASING
pdch_ul_controller.c:330 PDCH(bts=0,trx=1,ts=7) Timeout for registered POLL (FN=612941, reason=UL_ASS): TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=RELEASING EGPRS)
tbf.cpp:550 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=RELEASING EGPRS) poll timeout for FN=612941, TS=7 (curr FN 612941)
tbf.cpp:589 UL_ASS_TBF(UL-TFI_1)[849e50]{WAIT_ACK}: Received Event ASS_POLL_TIMEOUT
tbf_ul_ass_fsm.c:224 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=RELEASING EGPRS) Timeout for polling PACKET CONTROL ACK for PACKET UPLINK ASSIGNMENT: |Assignment was on PACCH|No uplink data received yet|
tbf_ul_ass_fsm.c:226 UL_ASS_TBF(UL-TFI_1)[849e50]{WAIT_ACK}: state_chg to SEND_ASS
tbf_ul_ass_fsm.c:308 UL_ASS_TBF(UL-TFI_1)[849e50]{SEND_ASS}: Received Event CREATE_RLCMAC_MSG
tbf_ul_ass_fsm.c:112 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=RELEASING EGPRS) start Packet Uplink Assignment (PACCH)
tbf_ul_ass_fsm.c:131 TBF(TFI=1 TLLI=0xe1c12303 DIR=UL STATE=RELEASING EGPRS) Scheduled UL Assignment polling on PACCH (FN=612976, TS=7)
tbf_ul_ass_fsm.c:188 UL_ASS_TBF(UL-TFI_1)[849e50]{SEND_ASS}: state_chg to WAIT_ACK

Change-Id: I94243ff99dfaf3664a1a4b3c4c87b5104ba4f7d1
2021-10-14 19:31:12 +02:00
Pau Espin b9fede74ef tbf: Avoid keeping poll nodes in pdch_ulc of temporary control_ts used during PACCH assignment
When MS sends us the Packet Resource Request as RRBP from final UL ACK/NACK, we create a new TBF
with a different set of allocated TS. However, we must send the Pkt UL Assignment with information
of the new TBF using that same TS where we receive the Packet Resource Request, which happens to
be the control TS of the previous/old TBF. The original control TS of the new TBF is kept in

Hence the code does gprs_rlcmac_pdch::rcv_resource_request():
ul_tbf->control_ts = ts_no;

And later, when we receive a CTRL ACK answering the Pkt UL Assigment, we change the control TS of
the new TBF back to the new one, by calling tbf_assign_control_ts(), which basically does:
tbf->control_ts = tbf->first_common_ts;

So, for instance we have a TBF which was allocated with tbf->control_ts=4 and hence is only attached
to PDCH 4 (tbf->pdch[]), but for which is temporarily applied tbf->control_ts=7.  Hence, when a poll
is requested, it is done in control_ts, aka 7, which is not in the array of attached PDCH.

The problem is of course if we never reach the point where the final control_ts is set, due to never
receiving the CTRL ACK. If the TBF is freed (due to timer X2001) before receiving the CTRL ACK and
hence tbf_assign_control_ts() is called, a crash may occur, because potentially a poll for the TBF is
left in TS 7 because it's not a PDCH attached to the TBF and hence poll
entries on that TS are not released, hence keeping a pointer to the
freed TBF.

Related: SYS#5647
Change-Id: I0c49f2695e0d932d956c01976c9458eebee63cd4
2021-10-12 20:07:19 +02:00
Pau Espin ffa2918bc5 pdch: rcv_data_block: Avoid releasing ULC entry if expecting something else on UL
Let's only release PDCH ULC entry if it was indeed what we expected.
In other case, time it out.

Change-Id: I1537587f5ee801c633784691b576ebb1ed521e95
2021-10-12 20:07:19 +02:00
Pau Espin 32744c8916 Return void in tbf_assign_control_ts()
This operation cannot fail, hence let's simplify code.

Change-Id: I5675df4b6309d680d1d5e2dbea87991468f30630
2021-10-12 19:36:49 +02:00
Pau Espin ffe998ce9d tbf: Document temporary change of control_ts and move code assigning it back to FSM
Change-Id: I1b7eb7802060778487e5729ee789b2323b6636f8
2021-10-12 19:32:28 +02:00
Pau Espin 38a9c873bc tbf: Use define to flag control_ts unset special value
Change-Id: Idd3ccec509b40b6229544b45e54da1142805b6f9
2021-10-12 19:18:57 +02:00
Pau Espin 85aa87b61f tbf_fsm: Handle MAX_N3105 in state ASSIGN
Seen on a runnig osmo-pcu against real MS:
pdch_ul_controller.c:329 PDCH(bts=0,trx=1,ts=7) Timeout for registered POLL (FN=751140): TBF(TFI=0 TLLI=0xe8c12143 DIR=UL STATE=ASSIGN EGPRS)
tbf.cpp:542 TBF(TFI=0 TLLI=0xe8c12143 DIR=UL STATE=ASSIGN EGPRS) poll timeout for FN=751140, TS=7 (curr FN 751140)
tbf.cpp:384 TBF(TFI=0 TLLI=0xe8c12143 DIR=UL STATE=ASSIGN EGPRS) N3105 exceeded MAX (8)
tbf.cpp:594 TBF(UL-TFI_0)[9bc050]{ASSIGN}: Received Event MAX_N3105
tbf.cpp:594 TBF(UL-TFI_0)[9bc050]{ASSIGN}: Event MAX_N3105 not permitted

It was first though when FSMs where introduced that an FSM in ASSIGN
state could not receive this kind of event because it was believed to be
sending no CTRL blocks at all until flow state. That's because the
believe was that Assignment over PACCH was done by another existing TBF.
It turns out this is usually the case, but not in all cases. In at least
one case, the tbf object (and tbf_fsm/tbf_{ul,dl}_ass_fsm) itself is
handling its own assignment (hence eg. sending the UL assignment and waiting
response through tbf_ul_ass_fsm. This happens if a UL TBF sends a Pkt
Resource Req as a response to RRBP of final UL ACK/NACK in order to
request a new TBF, where it temporarily uses the control_ts of the
previous TBF to get a new Pkt UL Assignment over PACCH.

If Pkt Ul Assignment doesn't receive a CTRL ACK, tbf_ul_ass_fsm will
retrnamist it, until MAX_N3015 is reached (the event we failed to
handle until now). At this point, we really want to transition to
RELEASING in order to avoid keeping the TBF allocating resources (until
X2001 times out).

Related: SYS#5647
Change-Id: I86d5c1bbccd06673d08451b812d149e727404733
2021-10-12 18:57:44 +02:00
Pau Espin 27a4e7371c tbf_ul_ass_fsm: Fix use of incorrect log macro
Change-Id: I61e46199086a3e82985606cf81995e27663c91f5
2021-10-12 17:53:44 +02:00