[SGSN] Fix processing of RA Update Request regarding TLLI

In case we get a RA UPD REQ on a new cell (both served by the same
SGSN), the LLC stack should not allocate a ne LLE/LLME, as the latter
would reset the V(u)sent / V(u)recv to zero and make the MS discard
our responses.

Instead, whenever the LLC stack sees a foreign TLLI, it should always
convert it to the local TLLI before doing any lookup for a LLE/LLME.

2 files changed, 27 insertions, 1 deletions

diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index 158f577a7..11c6356fc 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -916,9 +916,14 @@ static int gsm48_rx_gmm_ra_upd_req(struct sgsn_mm_ctx *mmctx, struct msgb *msg,
 		return gsm48_tx_gmm_ra_upd_rej(msg, GMM_CAUSE_MS_ID_NOT_DERIVED);
 	}
 
+	/* Store new BVCI/NSEI in MM context (FIXME: delay until we ack?) */
+	msgid2mmctx(mmctx, msg);
+	/* Bump the statistics of received signalling msgs for this MM context */
+	rate_ctr_inc(&mmctx->ctrg->ctr[GMM_CTR_PKTS_SIG_IN]);
+
 	/* Update the MM context with the new RA-ID */
 	bssgp_parse_cell_id(&mmctx->ra, msgb_bcid(msg));
-	/* Update the MM context with the new TLLI */
+	/* Update the MM context with the new (i.e. foreign) TLLI */
 	mmctx->tlli = msgb_tlli(msg);
 	/* FIXME: Update the MM context with the MS radio acc capabilities */
 	/* FIXME: Update the MM context with the MS network capabilities */
diff --git a/openbsc/src/gprs/gprs_llc.c b/openbsc/src/gprs/gprs_llc.c
index 69c80417f..e873420ad 100644
--- a/openbsc/src/gprs/gprs_llc.c
+++ b/openbsc/src/gprs/gprs_llc.c
@@ -107,11 +107,28 @@ static const struct gprs_llc_params llc_default_params[] = {
 LLIST_HEAD(gprs_llc_llmes);
 void *llc_tall_ctx;
 
+/* If the TLLI is foreign, return its local version */
+static inline uint32_t tlli_foreign2local(uint32_t tlli)
+{
+	uint32_t new_tlli;
+
+	if (gprs_tlli_type(tlli) == TLLI_FOREIGN) {
+		new_tlli = tlli | 0x40000000;
+		DEBUGP(DLLC, "TLLI 0x%08x is foreign, converting to "
+			"local TLLI 0x%08x\n", tlli, new_tlli);
+	} else
+		new_tlli = tlli;
+
+	return new_tlli;
+}
+
 /* lookup LLC Entity based on DLCI (TLLI+SAPI tuple) */
 static struct gprs_llc_lle *lle_by_tlli_sapi(uint32_t tlli, uint8_t sapi)
 {
 	struct gprs_llc_llme *llme;
 
+	tlli = tlli_foreign2local(tlli);
+
 	llist_for_each_entry(llme, &gprs_llc_llmes, list) {
 		if (llme->tlli == tlli || llme->old_tlli == tlli)
 			return &llme->lle[sapi];
@@ -322,6 +339,8 @@ int gprs_llc_tx_ui(struct msgb *msg, uint8_t sapi, int command,
 	lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi);
 	if (!lle) {
 		struct gprs_llc_llme *llme;
+		LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, "
+			"creating LLME on the fly\n", msgb_tlli(msg));
 		llme = llme_alloc(msgb_tlli(msg));
 		lle = &llme->lle[sapi];
 	}
@@ -678,6 +697,8 @@ int gprs_llc_rcvmsg(struct msgb *msg, struct tlv_parsed *tv)
 			struct gprs_llc_llme *llme;
 			/* FIXME: don't use the TLLI but the 0xFFFF unassigned? */
 			llme = llme_alloc(msgb_tlli(msg));
+			LOGP(DLLC, LOGL_DEBUG, "LLC RX: unknown TLLI 0x08x, "
+				"creating LLME on the fly\n", msgb_tlli(msg));
 			lle = &llme->lle[llhp.sapi];
 		} else {
 			LOGP(DLLC, LOGL_NOTICE,