Commit Graph

8 Commits

Author SHA1 Message Date
Pau Espin 4f67a9bf46 pdch: Fix heap-use-after-free in pdch->ulc
In existing previous code, pdch->ulc would be freed in
gprs_rlcmac_pdch::free_resources() when  it became disabled as per PCUIF
info_ind (for instance, when a DYN TS is switched PDCH->SDCCH8).
However, pdch->ulc was so far only allocated during pdch_init, which is
only called during bts_alloc() time.
Hence, after first info_ind disabling it, if it became again enabled
(again by info_ind re-enabling it after SDCCH8 was not longer in use),
the pdch->ulc would be used again but it would point to freed memory.

Let's rearrange how/when resources are freed to make it more logical.
With this patch, pdch internal resources are freed upon ->disable(), and
re-allocated upon ->enable().

Change-Id: Id51f5f6a54ac9f24b784c17bc360ac38f5726fc7
2021-07-01 13:09:10 +02:00
Pau Espin 1a1557a60a Move TBF list from BTS to the TRX structure
The TBFs are managed per TRX. Move the global list from BTS to TRX.

Related: OS#1541
Change-Id: Id3c59c11d57d765fe68aaebaac94290c0d84feb2
2021-05-19 12:50:25 +02:00
Pau Espin 86580e1966 pdch_ulc: Store TBF poll reason
This allows easily checking the initial reason to trigger the poll when
either it is received or times out.

Later on this reason can be transformed into an FSM event and sent to
the related FSM.

Related: OS#5020
Change-Id: Ie8fefd1f47ad674ce597a8065b15284088956bde
2021-03-31 17:39:50 +02:00
Pau Espin 50a1ede693 pdch_ulc: Support picking RRBP other than N+13
Current algo always tries to sched RRBP the soonest possible.

Related: OS#5020
Change-Id: Ic6ddeea70e1f914cf423d0daab8fc492d0c992e2
2021-03-31 17:39:50 +02:00
Pau Espin ce3bd2522a Pick unreserved UL FN when allocating an SBA
Make sure an unreserved FN is picked and reserved when allocating and
scheduling an SBA.
In practice this has no change in behavior right now, since anyway using
an offset of 52 FNs ensure no USF or POLL has alredy been scheduled that
far in the future. Since it's also impossible to allocate more than 1
SBA per PDCH and RTS FN, we are also safe about multiple SBAs being
allocated, because we use a hardcoded offset of 52.
However, that could change in the future, when we dynamically tweak the
current offset of 52 FN based on information from BTS about its AGCH
queue load:
* If load is high, we may need to increase the offset since it
will take more time for the BTS to transmit the TBF and hence we must
reserve a TBF starting time further in the future (higher FN).
* If load turns low, we may schedule next SBA a bit more nearby in time
  than the previously allocated SBA, hence here there could be a
  collision.

Related: OS#5020
Change-Id: I2d4e21e2307de6c17748e8da5c7e149c947a7eb9
2021-03-31 17:39:50 +02:00
Pau Espin c7cc4162e1 ulc: Fix FN store order upon wrap around
Related: OS#5020
Change-Id: I0a742f7fa1541b1837739207b9383772f981fb25
2021-03-15 19:36:56 +01:00
Pau Espin 95f8fa1f7c tests: ulc: Show current bug with FN wrap around
Issue will be fixed in next commit. Leaving ASSERTs disabled so that
test passes in jenkins.

Related: OS#5020
Change-Id: I657db6b300363f8f3a9e4cfaf7a7f49e361a0512
2021-03-15 19:36:27 +01:00
Pau Espin 582a15e413 tests: Introduce unit tests for PDCH UL Controller
Related: OS#5020
Change-Id: Ie1ff0ca3d7fc8a9824d6fe4dceb746e301082bda
2021-03-15 19:35:43 +01:00