This commit adds MS object creation and cleanup to the TBF related
code. MS objects are created when a TBF that has been "anonymous" so
far gets associated with a TLLI. When a TBF is replaced by another,
the old TBF is detached and the new one is attached to the MS. When
all TBFs have been detached, the MS object gets deleted.
The TBF related code should not call attach_tbf/detach_tbf directly
but use set_ms instead to make sure, that the references are updated
properly. GprsMs::detach_tbf also calls set_ms(NULL) on the detached
TBF object.
The MS object is not really used yet, the focus is still on object
creation, TBF association, and cleanup.
Ticket: #1674
Sponsored-by: On-Waves ehf
Currently only TBF objects are used to handle the data flow between
the MS and the SGSN. MS specific data (e.g. pending LLC frames, TLLI)
is copied between successive TBFs. If all TBFs (uplink and downlink)
are idle for some time, all information about the MS is discarded in
the PCU. This makes the implementation of some features more
difficult, e.g. proper TLLI and timing advance handling,
connection based CS selection, and proper management of multiple TBF.
This commit adds the GprsMs class that is intended to hold
information directly related to the MS and to keep references to the
active TBFs.
The class is not yet integrated with the other PCU code. A GprsMs
object container and MS specific fields (TA, CS) will be added in
later commits.
Note that calling detach_tbf() can possibly delete the MS object
depending on the callback implementation.
Ticket: #1674
Sponsored-by: On-Waves ehf
Currently the ul_tbf is used in its own declaration as an argument to
tbf_alloc_ul_tbf, where dl_tbf can be used instead and makes more
sense.
This commit uses dl_tbf instead of ul_tbf as old_tbf.
Addresses:
tbf/TbfTest.cpp:71:14: warning: ‘ul_tbf’ may be used uninitialized in
this function
Sponsored-by: On-Waves ehf
Currently the global current_test is not initialised, which leads to
memory access failures. In addition, the variable is signed but used
in comparisons with unsigned values.
This commit changes the type to size_t and initialises the variable
to 0.
Sponsored-by: On-Waves ehf
These fixes do not affect the semantics of the code. They either help
gcc by providing default values that won't be used ("may be
uninitialised"), remove unused variables, or change signed to
unsigned variables to avoid comparison warnings.
Addresses:
bts.cpp:494:32: warning: 'tbf' may be used uninitialized in this
function
emu/test_replay_gprs_attach.cpp:81:27: warning: comparison between
signed and unsigned integer expressions
emu/test_pdp_activation.cpp:95:23: warning: unused variable ‘budh’
emu/test_pdp_activation.cpp:97:6: warning: variable ‘rc’ set but
not used
emu/pcu_emu.cpp:109:26: warning: unused variable ‘bts’
alloc/AllocTest.cpp:74:27: warning: unused variable ‘tbf’
osmocom/core/utils.h:13:50: warning: comparison between signed and
unsigned integer expressions
types/TypesTest.cpp:319:7: warning: unused variable ‘count’
types/TypesTest.cpp:320:11: warning: unused variable ‘rbb’
alloc/AllocTest.cpp:74:27: warning: unused variable ‘tbf’
alloc/AllocTest.cpp:132:11: warning: unused variable ‘ts_no’
Currently the PCU silently discard LLC frames from the SGSN if a
DL TBF cannot be allocated.
This commit changes tbf_new_dl_assignment and reuse_tbf to send an
LLC discarded message to the SGSN in this case.
Ticket: #607
Sponsored-by: On-Waves ehf
If an MS wants to open a new UL TBF, it can either use (P)RACH or
request one in a Ack/Nack message for a DL TBF (PACCH). When a TBF
becomes idle (LCC queue is empty but the TBF is kept open), there
aren't any Ack/Nack requests that can be used by the MS to ask for an
UL TBF, therefore it has to use the RACH. This leads to many RACH
requests even for a single HTTP transaction, so it takes some time to
retrieve even a simple web page.
This commit modifies the scheduler to regularly send Ack/Nack
requests on idle DL TBFs. It does so by extending the priority based
scheduling algorithm to have 5 priority levels (highest priority
first):
- Control block is pending
- High age (100%) threshold reached (-> request Ack/Nack)
- Data is waiting or there are pending Nacks
- Low age (200ms) threshold reached (-> request Ack/Nack)
- Pending Nacks that have been resent already
- None of the above (-> send DL dummy control block)
The 'age' refers to the time since since the last control block has
been sent on the TBF. This high age threshold is set to
dl-tbf-idle-time or to 50% of T3190 (whichever is smaller), aiming
for at least a poll (and TBF shutdown) after the TBF has expired and
to safely prevent expiry of T3190. So if dl-tbf-idle-time > 200ms,
there will be a poll every 200ms and a final poll after
dl-tbf-idle-time. On high load, the interval between polls can get
higher, but the 'high age' poll should be in place.
This commit implements the scheduling with respect to GSM 44.060,
9.3.1a ("Delayed release of downlink TBF").
Ticket: #556
Sponsored-by: On-Waves ehf
Currently if append_data() is used when there is no LLC data in the DL TBF,
it will either call reuse_tbf() which in turn will call put_frame(),
or it will append the LLC message to the queue, even if the queue and
the frame buffer are empty. This only happens with the test case so
far, but this would change when idle DL TBFs are kept open for some
time. It results in empty LLC message being sent to the MS (see log
below).
This commit changes append_data to check for this case and to
eventually use put_frame() instead of appending the LLC data to the
queue.
Addresses:
TBF(TFI=0 TLLI=0x00000000 DIR=DL STATE=FLOW) downlink (V(A)==0 ..
V(S)==0)
- Sending new block at BSN 0
-- Chunk with length 0 is less than remaining space (20): add length
header to to delimit LLC frame
Complete DL frame for TBF(TFI=0 TLLI=0x00000000 DIR=DL STATE=FLOW)len=0
- Dequeue next LLC for TBF(TFI=0 TLLI=0x00000000 DIR=DL STATE=FLOW)
(len=200)
Sponsored-by: On-Waves ehf
Currently fn and block_nr are not incremented correctly. In addition,
the comments around the sending of blocks are not accurate either.
This commit introduces the send_rlc_block helper function which takes
care of the increments, updates the comments to reflect what is
really happening, and adds assertion to verify at least some aspects
of what is now stated in the comments.
Sponsored-by: On-Waves ehf
Put the generic parts of test_tbf_final_ack into helper functions to
reduce the size of the test and to avoid too much code duplication
when creating new tests.
Sponsored-by: On-Waves ehf
Currently tbf->m_new_tbf may point to itself if no new TBF is
assigned. But this leads to additional logging messages, since the
code in set_new_tbf and tbf_free assumes, that a real new TBF is
assigned and generates log messages accordingly.
This commit adds checks to avoid those messages in the above case.
Sponsored-by: On-Waves ehf
Currently tbf_name() must not be used twice in a printf statement
with different TBFs, since the same baffer will be used for each.
This commit puts the text buffer into struct gprs_rlcmac_tbf to avoid
this problem.
Sponsored-by: On-Waves ehf
Currently if a 'new' TBF is freed before the 'old' one (where
old_tbf->m_new_tbf == new_tbf), the old_tbf->m_new_tbf is not cleared
and can be accessed later on. This can lead to inconsistencies or
segmentation faults.
This commit adds m_old_tbf which points back from new_tbf to old_pdf.
m_new_tbf and m_old_tbf are either both set to NULL or one is the
reverse pointer of the other (tbf->m_new_tbf->m_old_tbf == tbf and
tbf->m_old_tbf->m_new_tbf == tbf). It extends set_new_tbf and
tbf_free to update the pointee accordingly.
The TBF test is extended to check this invariant at several places.
Sponsored-by: On-Waves ehf
When new_tbf is freed before dl_tbf in test_tbf_final_ack, dl_tbf
still contains a pointer to it in m_new_tbf.
This patch changes the test to accept a test mode parameter and runs
it twice which a different order of tbf_free in each run. Consistency
checks are added, to check for a danglilng m_new_tbf pointer in both
cases.
Sponsored-by: On-Waves ehf
Currently libgprs.la is listed after libosmocore.so which leads to
link errors when compiling under Ubuntu with the system build tools
(no cross compiling).
This patch moves libgprs.la in front of the external libs.
Sponsored-by: On-Waves ehf
The test called the llc enqueue() function directly which didn't take
care of prepending the tv values for the timeout to the data.
Now the test uses dl_tbf.append() which takes care of prepending the tv
values. With this patch make distcheck on jenkins should no longer fail
with "Discarding LLC PDU because lifetime limit reached." messages.
There is no need for the union/struct anymore. Make the variable members
of the UL/DL class.
As a result gprs_rlc_dl_window gets a reset() method because
memset(&dir.dl, 0, sizeof(dir.dl)) doesn't work anymore in reuse_tbf().
Ticket: SYS#389
Sponsored by: On-Waves ehf
UL and DL tbfs are used in very separate parts and are not the same
thing so split the alloc function and use the UL/DL version throughout
the code.
Ticket: SYS#389
Sponsored-by: On-Waves ehf
Move functions resend_needed(), mark_for_resend(), update(),
move_window(), state(), count_unacked() out of v_b directly into the UL
window and provide a function get_state in v_b to access the v_b
elements.
When cross-compiling osmo-bts/osmo-pcu one can not easily
execute the testsuite. By adding the OSMO_QEMU variable in
front of the normal execution we can execute the tests. This
should work for native and cross builds.
$ OSMO_QEMU="qemu-arm -L /opt/poky/1.1.2/sysroots/armv5te-poky-linux-gnueabi/" make check
Make a crazy test that will test each possible PDCH configuration
and MS Class and verify that the UL/DL assignments work and that
they are on the same first_common_ts.
The allocation in the TBF/BTS code is quite complex. In parts this
is due the assignment and requests occuring under differen circumstances.
Attempt to re-create the commono scenarios.
Remove the bogus msclass check in gprs_rlcmac_tbf::update as the
allocation code will check the ms class anyway.
Coverity complains about this code as it doesn't know that the
OSMO_ASSERT is always on. But it is good practice to now have the
side-effect in here.
Fixes: Coverity CID 1080724
* Make append_data, remaining_space and fits_in_current.. work
on m_length and not the index. This ways things can't overflow.
* The current API consumer was moving the m_index so it should have
worked okay.
During a routing area update a new P-TMSI was assigned. During
the PACKET CONTROL ACK on the DL we notice the change of TLLI
but didn't propagate this. This means that a Routing Area Update
Complete was only sent after a new RACH request.
Addresses:
<0007> gprs_rlcmac_meas.cpp:103 UL RSSI of TLLI=0x88661bc6: -67 dBm
<0002> bts.cpp:945 Got ACK, but UL TBF is gone TLLI=0xe512eba3
<0007> gprs_rlcmac_meas.cpp:158 DL packet loss of IMSI=274080000004765 / TLLI=0xe512eba3: 0%
<0002> tbf.cpp:668 TBF TFI=0 TLLI=0x88661bc6 T3169 timeout during transsmission
<0002> tbf.cpp:690 - Assignment was on PACCH
<0002> tbf.cpp:694 - No uplink data received yet
The list belongs to the BTS. This makes cleaning this up more easy
and establishes a hierachy of resources that start from the BTS. The
debug_diagram code is now broken.
When a PDCH is disabled all resources should be freed. This is
currently not possible as the PDCH does not know where it belongs
to. On top of that the list (and other resources) should be
properly initialized on construction so that disable() is idempotent
and does not check if it was disabled. During the re-factoring I
noticed that during a sysmobts re-start some resources are not
freed. I left a warning in the code to resolve this issue later.
Compared to the previous code there will be a branch to get the
global pointer so the code will be slightly slower than the previous
version but it allows us to start creating objects but still use
the code from C. It is best approach I have found so far.
One downside of C++ is that by default talloc will not be used
(unless we override the new operator to use talloc. Right now
we need to memset the C data structure by hand. The benefit of
enforcing a better structure should is more important though.
Introduce the concept of tests that will be ran one after the other.
This new test will send static message that will lead to the opening
of a PDP context. At this point one should use ping with a large
packet size and suspend/stop the emulator. Once the NS connection is
considered dead the SGSN will crash with a double free.
Reproduce:
0.) Add IMSI 901700000003094 to the ACL
1.) Stop/Suspend the emulation process so the NS Alive times out
2.) Use ping IP -s 2048
This will create a double free...
#4 0xb7bb2646 in talloc_abort_double_free () at talloc.c:175
#5 0xb7bbd41a in talloc_chunk_from_ptr (ptr=0x8091208) at talloc.c:190
#6 _talloc_free (ptr=0x8091208) at talloc.c:517
#7 talloc_free (ptr=ptr@entry=0x8091208) at talloc.c:990
#8 0xb7bb319b in msgb_free (m=m@entry=0x8091208) at msgb.c:72
#9 0x0804db54 in sndcp_send_ud_frag (fs=0xbfffcc6c) at gprs_sndcp.c:423
#10 sndcp_unitdata_req (msg=msg@entry=0x808eed8, lle=0x808fbc8, nsapi=5 '\005',
mmcontext=mmcontext@entry=0x80903e8) at gprs_sndcp.c:471
This will send a static message. It will trigger the GMM code
on the SGSN and might ask us for the IMEI/IMSI or send us an
accept. As we are not replying at all the SGSN needs to send new
requests and we can observe if the sequence number is increasing
like it should.
As a last minute change I probably ran git rebase --whitespace=fix
on the patch set and broke the test result. Update the expected
file and tests should pass.
Jacob Erlbeck
Daniel Willmann