Current UDP receive reads up to MAX_UDP_LENGTH bytes into the
passed in buffer, which may lead to buffer overflow if the
write buffer is of insufficient size.
Add mandatory length argument to UDP socket receive calls.
Reported-by: Simone Margaritelli <simone@zimperium.com>
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Reported security vulnerability where control and data UDP
packets can be injected into the transceiver externally due
to socket binding to all interfaces using INADDR_ANY.
Existing socket interface does not allow specifying local
address; only the local port and remote address/port are
arguments.
Restrict socket bind to localhost with INADDR_LOOPBACK. If
external interfaces do need to be used, the API should be
modified to allow specifying the local socket address.
Reported-by: Simone Margaritelli <simone@zimperium.com>
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
EDGE 8-PSK soft slicer was receiving input from the output of the
downsampler. Equalization and derotation were missing causing the
soft symbol output to be invalid.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Delay the EDGE downlink bursts by one symbol in order to match GMSK
pulse shaping group delay. The difference in group delay arises from
the dual pulse filter combination of the GMSK Laurent represenation
whereas 8-PSK uses a single pulse linear filter.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Previously MAXDLY value was applied to Normal Bursts, which was nice
when working with sloppy test equipment like CMD57, but useless for
real world usage. At the same time documentation and de facto usage
of MAXDLY in OsmoBTS and OpenBTS assumed that it actually applies to
Access Bursts (RACH). So this patch changes osmo-rx behavior to apply
MAXDLY to RACH bursts and introduces a new command MAXDLYNB for the
old behavior.
debugLogEarly was replaced to an empty space and arguments of the function
became operators, grouped together by ():
Configuration.cpp: In member function 'bool ConfigurationTable::defines(const string&)':
Configuration.cpp:272:28: warning: left operand of comma operator has no effect [-Wunused-value]
debugLogEarly(LOG_ALERT, "configuration parameter %s not found", key.c_str());
^
This fix removes debugLogEarly together with its arguments.
Commit 871b8782 "EDGE: Add support for UmTRX" disabled B210 support
using EDGE. Add B210 explicitly to the timing offset table to avoid
this issue.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
There doesn't seem to be a reason why this shouldn't be in master.
The fairwaves/master branch is removing --march=native as well that
looks like a good idea as well.
Timing recovery and single tap channel compensation are identical
in both GMSK and EDGE receivers. This is the section ahead of and
including the optional 4-1 downsampler. GMSK and EDGE specific
sections operate at 1 SPS.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
When EDGE is enabled with the '-e' option, the random burst generator
switches from GMSK normal bursts to 8-PSK EDGE bursts.
$ ./osmo-trx -e -r 7
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Setup generators for empty, random, and dummy bursts. This moves error
prone burst length handling out of the Transceiver and into the signal
processing core.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
At 4 samples per symbol, we don't need to maintain the 156/157 sample
slot structure to account for the GSM 156.25 sample burst length.
Set the 4 SPS Laurent modulator to ignore the guard interval setting
and always output 625 sample sized bursts. The EDGE 8-PSK modulator
already has this behavior.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Create EDGE slot type in the Transceiver. When EDGE mode is enabled
for a particular slot, blind detection will be performed by
correlating against EDGE followed by normal bursts if no EDGE burst
is found.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Setup correlator and detection process similar to the GMSK
receiver chain. Require 4 SPS sampling on both Rx and Tx paths
as 1 SPS sampling adds too much distoration for 8-PSK recovery.
Core receiver operations still run at 1 SPS with the exception
of fractional delay filtering, which runs at the higher rate.
Perform linear equalization to handle the Gaussian pulse
induced ISI. The fixed impulse response used for equalizer tap
calculation consists of combined EDGE pulse shape filter and
effects of the downsampling filter. Note that the non-adaptive
equalizer corrects for modulation induced band limiting and
does not account for or compensate for fading channel effects.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Allow setting the device to non single SPS sample rates - mainly
running at 4 SPS as the signal processing library does not support
other rates. Wider bandwith support is required on the receive path
to avoid 8-PSK bandlimiting distortion for EDGE.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
DFE equalizer is unused and has been experiencing code rot for
multiple years. The effect is a significant amount of baggage being
carried in the Transceiver and interfaces.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Samples per symbol used by the transceiver is not configurable through
the socket interface once running, so stop pretending like it could be.
Initialize all tables and midambles at start.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Patch f147b174 "sigproc: Make convolution and convert input buffers
immutable" changed the internal conversion interface with the addition
of the const type qualifier. This change was not reflected on ARM builds
which led to build failure. Add const qualifier to resolve build issue.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Certain pre-release versions of the B200mini used the B205 naming, which no
longer exists. Update device naming and detection to reflect current UHD
product names.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
UHD handles built in tick and floating point timestamp conversion
since version 003.005.004. This removes the need for separate UHD
timespec to tick conversion.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Commit 90f7a01d lost "return" statement. We also should account the fact that
offset can be negative.
We should return the tuning request immediately after
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Rounding error introduced oscilating timing advance error by regularly
overwriting one bit and then skipping one bit.
This commit also adds an error message to show up in logs if this ever
happens again.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
As a side change - get rid of passing toa and amp arguments as pointers and use
references instead.
The commit doesn't change behaviour, but makes the code cleaner.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
We can't rely on an assumption that if we can't decode a burst - it's noise.
There are many rasons why we can't decode a burst even if it's well above the
noise level. Just one example is a RACH burst which can be overlapped with
another RACH burst up to a level both are completely unrecognizable. Another
example is when a burst is destroyed by bad multi-path.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
It does more harm than good. the current noise calculation is too error
prone, so we can't trust it. And we end up loosing perfectly good bursts
because of that.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
There are two primary changes in this commit:
1) Return values of detect functions changed form bool to int to actually pass
the return value from the inner function and notify higher levels about clipping.
Previously the information was lost due to conversion to bool.
2) Clipping level is not the final verdict now. We still try to demod a burst
and mark it as clipped only if the level is above the clipping level AND we can't
demod it. The reasoning for this is that in real life we want to do as much as
possible to demod the burst, because we want to get as much from our dynamic
range as possible. So a little bit of clipping is fine and is expected. We just
don't want too much of it to break our demod.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
R&S CMD57 complains about the start phase of bursts, particularly it shows
-15 to -30 deg of error for the bit 0.5 position (start tail bit). This patch
makes it happy. ETSI TS 145 004 section 2.2 describes this: "Before the first
bit of the bursts as defined in 3GPP TS 45.002 enters the modulator,
the modulator has an internal state as if a modulating bit stream consisting
of consecutive ones (di = 1) had entered the differential encoder."
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Receive thread receives data from the device, which is a more stable source of
clocking than the transmit side. If transmit side has a hiccup, osmo-trx doesn't
send the clock indication, and transmit side is getting completely lost in time.
With this patch we ensure that clock indication keeps coming.
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
Filler types was of "bool" type, which prevented it from taking values greter
than 1. And RAND filler type has integer value of 2, which was casted to 1 on
assigning, which led to a normal filler table being used instead of the RAND
one.
Tom Tsou