Age | Commit message (Collapse) | Author | Files | Lines |
|
The MphInit operation will undo the muting. So we need to mute
directly after the init again.
|
|
This could lead to a BSC attempting to release the BCCH or a
PDCH. In the case of the BCCH this lead to a funny crash.
Log:
<0000> rsl.c:605 (bts=0,trx=0,ts=0,ss=4) Sending Connection Failure: cause = 0x01
<0000> rsl.c:1720 (bts=0,trx=0,ts=0,ss=0) Rx RSL DEACTIVATE_SACCH
Backtrace:
Program received signal SIGSEGV, Segmentation fault.
msgb_dequeue (queue=0x4007d2d8) at msgb.c:102
102 llist_del(lh);
(gdb) bt
#0 msgb_dequeue (queue=0x4007d2d8) at msgb.c:102
#1 0x4002ed28 in lapd_dl_flush_tx (dl=0x4007d220) at lapd_core.c:173
#2 0x40030cb4 in lapd_dl_reset (dl=0x4007d220) at lapd_core.c:307
#3 0x40030d00 in lapd_dl_exit (dl=0x4007d220) at lapd_core.c:321
#4 0x40033d80 in lapdm_entity_exit (le=<optimized out>) at lapdm.c:169
#5 0x40033d9c in lapdm_channel_exit (lc=0x4007d214) at lapdm.c:180
#6 0x0001a334 in rsl_tx_rf_rel_ack (lchan=0x4007d180) at rsl.c:505
#7 0x0000e908 in lchan_deactivate_sapis (lchan=0x4007d180) at oml.c:1427
#8 sapi_queue_exeute (lchan=0x4007d180) at oml.c:547
#9 0x0000ead0 in sapi_queue_send (lchan=<optimized out>) at oml.c:571
#10 queue_sapi_command (lchan=<optimized out>, cmd=<optimized out>)
at oml.c:609
#11 queue_sapi_command (lchan=0x4007d180, cmd=<optimized out>) at oml.c:601
#12 0x0000faf0 in enqueue_rel_marker (lchan=0x4007d180) at oml.c:1440
#13 lchan_deactivate (lchan=0x4007d180) at oml.c:1447
#14 0x0001004c in bts_model_rsl_chan_rel (lchan=<optimized out>) at oml.c:1647
#15 0x0001b948 in rsl_rx_rf_chan_rel (lchan=0x4007d180) at rsl.c:844
#16 rsl_rx_dchan (msg=0x75a88, trx=0x4007b038) at rsl.c:1727
#17 down_rsl (trx=0x4007b038, msg=0x75a88) at rsl.c:1853
#18 0x000154d4 in sign_link_cb (msg=<optimized out>) at abis.c:132
#19 0x400701c0 in ?? () from /usr/lib/libosmoabis.so.2
#20 0x400701c0 in ?? () from /usr/lib/libosmoabis.so.2
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
Fixes: OW#1133
|
|
When closing the PCU socket all channels will be closed. In that case
the LAPDm structures might not have been allocated. Mark the channel
as LCHAN_REL_ACT_PCU to avoid going through the RSL code for sending
the message. This avoids a crash when "gprs none" is selected but one
still configures a PDCH and then connects/disconnects the pcu.
#0 llist_del (entry=0x0) at ../include/osmocom/core/linuxlist.h:119
#1 msgb_dequeue (queue=0x400bbc58) at msgb.c:102
#2 0x40110d28 in lapd_dl_flush_tx (dl=0x400bbba0) at lapd_core.c:173
#3 0x40112cb4 in lapd_dl_reset (dl=0x400bbba0) at lapd_core.c:307
#4 0x40112d00 in lapd_dl_exit (dl=0x400bbba0) at lapd_core.c:321
#5 0x40115d80 in lapdm_entity_exit (le=<optimized out>) at lapdm.c:169
#6 0x40115d9c in lapdm_channel_exit (lc=0x400bbb94) at lapdm.c:180
#7 0x0001a334 in rsl_tx_rf_rel_ack (lchan=0x400bbb00) at rsl.c:505
#8 0x0000e908 in lchan_deactivate_sapis (lchan=0x400bbb00) at oml.c:1427
#9 sapi_queue_exeute (lchan=0x400bbb00) at oml.c:547
#10 0x0000ead0 in sapi_queue_send (lchan=<optimized out>) at oml.c:571
#11 queue_sapi_command (lchan=<optimized out>, cmd=<optimized out>) at oml.c:609
#12 queue_sapi_command (lchan=0x400bbb00, cmd=<optimized out>) at oml.c:601
#13 0x0000faf0 in enqueue_rel_marker (lchan=0x400bbb00) at oml.c:1440
#14 lchan_deactivate (lchan=0x400bbb00) at oml.c:1447
#15 0x0001004c in bts_model_rsl_chan_rel (lchan=<optimized out>) at oml.c:1647
#16 0x0001de30 in pcu_sock_close (state=0x62788) at pcu_sock.c:654
#17 0x0001e150 in pcu_sock_read (bfd=0x627a8) at pcu_sock.c:698
#18 pcu_sock_cb (bfd=0x627a8, flags=1) at pcu_sock.c:755
|
|
This reverts commit bbfd21a36cdd10c3b8d83a329042d9ebfb4c5250.
|
|
Currently, the DSP is always configured with u8NbrOfAgch = 1 before
SYSINFO type 3 is received. Thus using a different value for
BS_AG_BLKS_RES may lead to inconsistencies and MS failing to receive
paging messages properly.
This patch adds a warning and error logging and should be reverted
when initialisation is done in proper order.
Sponsored-by: On-Waves ehf
|
|
This patch adds a common function bts_ccch_copy_msg() that provides
and schedules AGCH and PCH messages. It is basically a frontend to
paging_gen_msg() and bts_agch_dequeue() and contains refactored code
from l1_if.c.
Sponsored-by: On-Waves ehf
|
|
This patch adds and updates btsb->agch_queue_length to keep track of
the queue length.
Sponsored-by: On-Waves ehf
|
|
Currently, the msg->data pointer is just set to the IMMEDIATE ASSIGN
message and the len is adjusted accordingly. Unfortunately, this
leaves l2h (pointing to the RSL header) and l3h (pointing to the
FULL_IMM_ASS_INFO IE) in an undefined state (outside of [data, tail]).
The code in bts.c accesses the message via msg->data.
This patch sets l3h and l2h correctly. msgb_l3() will point to the
start of the IMM ASS message and should be used instead of msg->data.
Sponsored-by: On-Waves ehf
|
|
This patch removes the local 'end' and 'exit' implementations (which
aren't used anyway) and uses the generic ones provided by libosmocore
instead, which are enabled automatically when vty_install_default()
is used.
The prompt strings are modified to match those in
libosmocore/openbsc.
Ticket: OW#952
Sponsored-by: On-Waves ehf
|
|
|
|
Use 0x52 as error cause as the nanoBTS is doing the same under the
situation. This has been spotted while testing handover using the
VTY command for handover.
|
|
Use 'var &= ~(1 << x)' to reset bits instead of 'var &= (1 << x)'.
Sponsored-by: On-Waves ehf
|
|
For journald we should not output escape sequences as it is
confusing the output.
|
|
Today we had the problem that multiple l1fwd-proxy instances ran
at the same time and not everything working all the time (some
packets were sent to a different host).
Another approach is to use flock on the message queues. This appears
to work fine as well.
|
|
Write the requested timing advance into the header. We are currently
using the u8AutoTA mode so the value will be overwritten by the DSP
before the bursts are sent to the MS.
|
|
When a frame is sent on the SACCH the LAPDm code will already
prepend two bytes for the tx_power and the ta. In the BTS we want
to use the values that were set by the BSC though. They currently
come from the RSL CHAN ACT but could also be set through the
RSL MS power control command. Update the comment as the space is
not empty.
At the 30C3 we had a NITB crash because of a RLL timeout on a
TCH/F. Jacob analyzed the problem and tracked it down to the
mismatch of LAPDm and the l1 interface to the DSP.
|
|
The PCU may call this function without a valid 'tp' (tlv parsed)
pointer, we need to make sure we take this into consideration...
|
|
The sysmoBTS L1 has the TSC as a global value, we cannot have individual
per-timestamp or even per-lchan TSC, as the GSM specification would
suggest (and other BTSs support).
Rather than fail silently, write an error message to the log and
return NM_NACK_PARAM_RANGE or RSL_ERR_SERV_OPT_UNIMPL back to the BSC.
|
|
If the channel couldn't be activated, the function can simply return
a negated RSL_ERR_* constant which will then be propagated towards
the BSC in an CHAN_ACT_NACK RSL message.
|
|
This way, bts_model_check_oml() can return a negated NM_NACK_* constant
which will then be sent as cause value in the corresponding
SET_ATTR_NACK back to the BSC.
|
|
In the MPH ACTIVATE-RF.req, we need to specify the nominal maximum
transmit power, i.e. >= what we later request during MPH-INIT.req.
This field was first introduced in API version 2.2, but we never used
it so far. It may help fixing a bug related to excessive power
consumption of the sysmoBTS 2050.
|
|
Address warning during system builds.
Addresses:
WARNING: QA Issue: No GNU_HASH in the elf binary...
|
|
Launch the sysmobts-mgr as well. It will monitor the temperature
but it will not update the eeprom or act on any of the data. On
top of that it will respond to ipaccess-find messages making it
more easy to find the device.
|
|
Fixes: Coverity CID 1157379
|
|
Bind to port 3006 and listen to incoming IPA requests. Currently
we unconditionally respond with the MAC and IP Address of the unit.
To determine the IP Address the kernel is asked for thesource
address of the route for the destination. In contrast to a nanoBTS
we will reply to the port the initial request came from.
|
|
Parse the daemonize option and daemonize after the full
set-up of the code.
|
|
|
|
For testing/trial it is better to not write to the EEPROM
but it is still good to see how the logic is working.
|
|
When cross-compiling osmo-bts/osmo-pcu one can not easily
execute the testsuite. By adding the OSMO_QEMU variable in
front of the normal execution we can execute the tests. This
should work for native and cross builds.
$ OSMO_QEMU="qemu-arm -L /opt/poky/1.1.2/sysroots/armv5te-poky-linux-gnueabi/" make check
|
|
When using the utility it is not clear which parameters can be
read or written. Make that more obvious.
|
|
|
|
The sysmoBTS takes quite a bit of CPU time for the vfprintf that
is used by osmo_hexdump. Do not dump every single frame to improve
the performance a bit.
|
|
In the perf the ARM EABI ddiv operation showed up in the most
of expensive symbols. It doesn't really make much sense as the
calls should only be done on configuration.
|
|
Most timeslots do not have eight lchan. Use the subslots_per_lchan
map to reduce the number of iterations. Looking at the ARM assembly
showed that no loop-unrolling was done so this could be a speed up.
|
|
|
|
calib_file.c: In function 'next_calib_file_idx':
calib_file.c:126:3: warning: implicit declaration of function 'band_femto2osmo' [-Wimplicit-function-declaration]
|
|
The parameter "uint8_t mute_state[8]" is actually a "uint8_t *mute_state"
so the ARRAY_SIZE is not what we think it is.
Fixes: Coverity CID 1125885
|
|
Fixes: Coverity CID 1047336
|
|
The information from band_mask has never been used as the return
was executed unconditionally.
Fixes: Coverity CID 1113473
|
|
Release/Free the lapdm resources _after_ the channel has
been fully released. Do not forward data unless the lchan
is in the active state.
Reading this code again, there is probably a memory leak for
everytime the PCU will re-connect to the BTS.
(gdb) p lchan->state
$4 = LCHAN_S_REL_REQ
(gdb) bt
#0 lapd_dl_flush_hist (dl=0x40454894) at lapd_core.c:164
#1 0x44873b54 in lapd_rx_u (lctx=0xbe9bd5a8, msg=0x92f90) at lapd_core.c:1040
#2 lapd_ph_data_ind (msg=0x92f90, lctx=0xbe9bd5a8) at lapd_core.c:1644
#3 0x44876d50 in l2_ph_data_ind (link_id=<optimized out>, chan_nr=<optimized out>,
le=<optimized out>, msg=0x92f90) at lapdm.c:637
#4 lapdm_phsap_up (oph=<optimized out>, le=<optimized out>) at lapdm.c:707
#5 0x0000c504 in handle_ph_data_ind (l1p_msg=0x97358, data_ind=0x97420, fl1=<optimized out>)
at l1_if.c:774
#6 l1if_handle_ind (fl1=<optimized out>, msg=0x97358) at l1_if.c:892
|
|
Use the lchan->rel_act_kind field for the BCCH activatiob by OML.
The lchan's should be marked as active but no event should be sent to
the BSC. This is mostly like the PCU. We can now remove the secnd
argument from lchan_activate.
|
|
There are existing deployments where the EEPROM either contains a
wrong value and/or the kernel can not be updated to support the
different EEPROM of revD. Revert to the old behavior that if no
nominal can be derived from the model_nr we assume that it is 23.
|
|
When using an old kernel on revD hardware we will read garabge
from the EEPROM and it is nice for debugging to see which model
number has been picked.
|
|
|
|
|
|
Nicolas ended up with linker issues due abis_rsl_sendmsg being
defined twice. Rename our version of the function and update the
code.
Patched with:
@i@
expression E;
@@
- abis_rsl_sendmsg(E)
+ abis_bts_rsl_sendmsg(E)
|
|
Currently it takes some time (around 30s) until it is detected that
the radio link is down after mute. Not till then the BSC is informed
and the call terminated.
This patch modifies this behaviour by sending a RSL_MT_CONN_FAIL
message with cause RSL_ERR_RADIO_LINK_FAIL for each muted and active
lchan immediately after the corresponding Change Administrative State
Request has been acknowledged.
Ticket: OW#976
Sponsored-by: On-Waves ehf
|
|
Currently only mute_state[0] (refers to ts[0]) is inspected to
determine, whether the Radio Carrier's state is set to LOCK.
This patch changes this by looking at all channels and using LOCK
if (and only if) all channels have been muted successfully.
Sponsored-by: On-Waves ehf
|
|
Currently the LEDs are being accessed directly from within the
l1_if.c file. So the handling of rf mute and activate/deactivate both
access LED_RF_ACTIVE directly. This may lead to an inconsistent LED
status.
This patch replaces these calls to sysmobts_led_set() by an abstract
equivalent bts_update_status(), that uses a set of independant status
ids. The associated values can than be combined into a visible LED
status. Currently LED_RF_ACTIVE is on iff BTS_STATUS_RF_ACTIVE is set
and BTS_STATUS_RF_MUTE is not set.
Sponsored-by: On-Waves ehf
|
|
Currently a Change Administrative State Request is just applied
unconditionally to the object's state object and then acknowledged.
This patch implements the special handling of setting the Radio
Carriers state to LOCK or UNLOCK. This is done by passing the
appropriate mute command to the L1 layer. Always all radio channels
are affected, it is not possible to lock single radio channels.
On success, an ACK is sent back to the bsc with the new state (based
on the state passed in the callback by the L1 layer). If something
went wrong or the firmware doesn't support RF mute, a NACK
(REQ_NOT_GRANTED) is sent instead.
Note that a NACK for such a request hasn't been sent by the BTS to
the BSC yet, so (albeit it's spec conformant to do so) the BSC must
be prepared to handle this correctly.
Ticket: OW#976
Sponsored-by: On-Waves ehf
|