Remove the global state from gprs_rlcmac_trigger_downlink_assignment
and walk up to the pcu_l1_if.cpp where I find the timeout handling
that should be part of the SBA and TBF functionality. In terms of
hierachies things start to be more clear.
There should be the BTS object. That holds the SBA and TBF Controllers
that can allocate TBFs and SBAs and will handle the timeout polling
for a BTS.
There was no difference but there is no point in poking in the
internals of the tbf, pdch and trx from various places. Information
hiding has a real purpose, e.g. compare with reading "the mythical
There really shouldn't be too many callers of state. Instead the
tbf should dispatch depending on the internal state. For now
introduce state_is and state_is_not accessor functions so we can
start to see who is using the internal state.
The TBF should use the IMSI to identify a block flow but all
handling is spread across the entire code. Start to clean this
up by moving relevant code into the tbf file. Afterwards one
can clean up and add more internal structure.
Do not claim that the payload is not known. Add the missing break.
Do not print:
<0002> gprs_rlcmac.cpp:1174 GPRS_RLCMAC_CONTROL_BLOCK_OPT block payload is not supported.
<0002> gprs_rlcmac.cpp:1176 Unknown RLCMAC block payload.
Introduce the concept of tests that will be ran one after the other.
This new test will send static message that will lead to the opening
of a PDP context. At this point one should use ping with a large
packet size and suspend/stop the emulator. Once the NS connection is
considered dead the SGSN will crash with a double free.
0.) Add IMSI 901700000003094 to the ACL
1.) Stop/Suspend the emulation process so the NS Alive times out
2.) Use ping IP -s 2048
This will create a double free...
#4 0xb7bb2646 in talloc_abort_double_free () at talloc.c:175
#5 0xb7bbd41a in talloc_chunk_from_ptr (ptr=0x8091208) at talloc.c:190
#6 _talloc_free (ptr=0x8091208) at talloc.c:517
#7 talloc_free (ptr=ptr@entry=0x8091208) at talloc.c:990
#8 0xb7bb319b in msgb_free (m=m@entry=0x8091208) at msgb.c:72
#9 0x0804db54 in sndcp_send_ud_frag (fs=0xbfffcc6c) at gprs_sndcp.c:423
#10 sndcp_unitdata_req (msg=msg@entry=0x808eed8, lle=0x808fbc8, nsapi=5 '\005',
mmcontext=mmcontext@entry=0x80903e8) at gprs_sndcp.c:471
This will send a static message. It will trigger the GMM code
on the SGSN and might ask us for the IMEI/IMSI or send us an
accept. As we are not replying at all the SGSN needs to send new
requests and we can observe if the sequence number is increasing
like it should.
For mocking/unit-testing/emulation (and a dual trx-systems) having
global state is quite bad. Cut back on the usage of the global
struct gprs_rlcmac_bts. It also makes the complexity of certain
routines more clear.