tbf: Clean old MS objects if they have the same TLLI

Currently if an MS retries to access the PCU by using RACH and if
there is already an entry for that MS, a duplicated MS object
referring to the same TLLI is created. This is caused by blindly
setting the TLLI without querying the MS storage to avoid
inconsitencies.

This leads to several entries in the MS storage that are assigned to
the same TLLI. If that happens, 'show ms all' can display multiple
entries with the same TLLI (note that an MS object can belong to
several TLLIs, so there might be an intersection that is not visible
in the list) or 'show tbf all' can show entries with MS_CLASS == 0 in
some cases.

This commit changes update_ms() to merge and clean up old entries
that belong to the given TLLI if they exist. Some data (like the MS
class) is copied to the new MS object.

Note that TBF belonging to the old MS object are deleted immediately
if they have not registered a timer.

Sponsored-by: On-Waves ehf

2 files changed, 21 insertions, 15 deletions

diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index 80bc8188..19895add 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -388,18 +388,23 @@ static void test_tbf_imsi()
 	OSMO_ASSERT(ms1 == ms2);
 
 	/* use the same IMSI on TBF 2 */
-	dl_tbf[1]->assign_imsi("001001000000002");
-	ms1 = the_bts.ms_store().get_ms(0, 0, "001001000000002");
-	OSMO_ASSERT(ms1 != NULL);
-	OSMO_ASSERT(ms1 != ms2);
-	OSMO_ASSERT(strcmp(ms1->imsi(), "001001000000002") == 0);
-	OSMO_ASSERT(strcmp(ms2->imsi(), "") == 0);
+	{
+		GprsMs::Guard guard(ms2);
+		dl_tbf[1]->assign_imsi("001001000000002");
+		ms1 = the_bts.ms_store().get_ms(0, 0, "001001000000002");
+		OSMO_ASSERT(ms1 != NULL);
+		OSMO_ASSERT(ms1 != ms2);
+		OSMO_ASSERT(strcmp(ms1->imsi(), "001001000000002") == 0);
+		OSMO_ASSERT(strcmp(ms2->imsi(), "") == 0);
+	}
+
+	ms2 = the_bts.ms_store().get_ms(0xf1000001);
+	OSMO_ASSERT(ms2 == NULL);
 
 	tbf_free(dl_tbf[1]);
 	ms1 = the_bts.ms_store().get_ms(0, 0, "001001000000002");
 	OSMO_ASSERT(ms1 == NULL);
 
-	tbf_free(dl_tbf[0]);
 	printf("=== end %s ===\n", __func__);
 }
 
diff --git a/tests/tbf/TbfTest.err b/tests/tbf/TbfTest.err
index 099504f8..35245222 100644
--- a/tests/tbf/TbfTest.err
+++ b/tests/tbf/TbfTest.err
@@ -462,20 +462,21 @@ The MS object cannot fully confirm an unexpected TLLI: 0xf1000002, partly confir
 Modifying MS object, TLLI = 0xf1000001, IMSI '' -> '001001000000001'
 Modifying MS object, TLLI = 0xf1000001, IMSI '001001000000001' -> '001001000000002'
 TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW) the IMSI '001001000000002' was already assigned to another MS object: TLLI = 0xf1000001, that IMSI will be removed
-Modifying MS object, TLLI = 0xf1000001, IMSI '001001000000002' -> ''
 Modifying MS object, TLLI = 0xf1000002, IMSI '' -> '001001000000002'
+Modifying MS object, TLLI = 0xf1000001, IMSI '001001000000002' -> ''
+TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW) free
+TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW) Software error: Pending downlink assignment. This may not happen, because the assignment message never gets transmitted. Please be sure not to free in this state. PLEASE FIX!
+PDCH(TS 4, TRX 0): Detaching TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW), 1 TBFs, USFs = 00, TFIs = 00000002.
+Detaching TBF from MS object, TLLI = 0xf1000001, TBF = TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW)
+********** TBF ends here **********
+Clearing MS object, TLLI: 0xf1000001, IMSI: ''
+Destroying MS object, TLLI = 0x00000000
 TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW) free
 TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW) Software error: Pending downlink assignment. This may not happen, because the assignment message never gets transmitted. Please be sure not to free in this state. PLEASE FIX!
-PDCH(TS 4, TRX 0): Detaching TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW), 1 TBFs, USFs = 00, TFIs = 00000001.
+PDCH(TS 4, TRX 0): Detaching TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW), 0 TBFs, USFs = 00, TFIs = 00000000.
 Detaching TBF from MS object, TLLI = 0xf1000002, TBF = TBF(TFI=1 TLLI=0xf1000002 DIR=DL STATE=FLOW)
 Destroying MS object, TLLI = 0xf1000002
 ********** TBF ends here **********
-TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW) free
-TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW) Software error: Pending downlink assignment. This may not happen, because the assignment message never gets transmitted. Please be sure not to free in this state. PLEASE FIX!
-PDCH(TS 4, TRX 0): Detaching TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW), 0 TBFs, USFs = 00, TFIs = 00000000.
-Detaching TBF from MS object, TLLI = 0xf1000001, TBF = TBF(TFI=0 TLLI=0xf1000001 DIR=DL STATE=FLOW)
-Destroying MS object, TLLI = 0xf1000001
-********** TBF ends here **********
 ********** TBF starts here **********
 Allocating DL TBF: MS_CLASS=45
 Creating MS object, TLLI = 0x00000000