aboutsummaryrefslogtreecommitdiffstats
path: root/src/osmo-bsc/bts_ipaccess_nanobts.c
AgeCommit message (Collapse)AuthorFilesLines
2018-10-31ipaccess_sign_link_reject: fix: use osmo_strlcpy() to safely copy IPOliver Smith1-1/+2
Fixes: coverity scan CID#189459 Change-Id: Ib9c5e374b9c5c8f79eecf95c439a25b0f438e4e5
2018-10-30vty: add 'show rejected-bts'Oliver Smith1-4/+52
Print IDs and IPs of recently rejected BTS devices. Example output: OsmoBSC> show rejected-bts Date Site ID BTS ID IP ------------------- ------- ------ --------------- 2018-10-25 09:36:28 1234 0 192.168.1.37 Related: OS#2841 Change-Id: Iba3bfe8fc9432b7ae8f819df8bd71b35b3ec507e
2018-08-23Fix heap-use-after-free due to OML link destructionPau Espin Pedrol1-1/+27
ipaccess_drop_oml was being called inside an osmo_fd cb context, were -EBADF must be returned if the structure holding the osmo_fd is freed. In the middle of the path (see OS#3495 for path tree) it goes through a signal dispatch, so it's impossible to make sure we return some value to the osmo_fd cb. As a result, it is required to defer dropping the OML Link from current code path and do it through a timer. Fixes following ASan report: 20180822124927913 <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed 20180822124927913 <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links. 20180822124927913 <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link. ... ================================================================= ==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78 READ of size 8 at 0x62e000060a68 thread T0 #0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371 #1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391 #2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217 #3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257 #4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922 #5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9) Fixes: OS#3495 Change-Id: I7c794c763481c28e8c35dc9b11d27969e16feb3c
2018-07-28fix nanobts: timeslot FSM: use flags to remember OML,RSL statusNeels Hofmeyr1-6/+0
Before this patch, the timeslot FSM receives OML and RSL ready events. Afterwards, it relies on examining the RSL and OML status to match the received events. This doesn't work for the ip.access nanobts, which fails to change the CHANNEL OM's operational status even though it has sent an Opstart ACK. We receive OML CHANNEL Opstart ACK, but the mo's state left at OP_STATE=Disabled. We apparently cannot rely on the gsm_abis_mo state as assumed before this patch, since changing the state depends on each BTS vendor's OML implementation. Also, implementation wise, it is better to not include assumptions on RSL and OML implementations in the timeslot FSM. Simply receive the OML and RSL ready events and remember that they arrived in dedicated flags. Remove the no longer needed oml_is_ts_ready() callback from struct gsm_bts_model added in: commit 91aa68f762218906e45be4817c6ea54b480da5e1 "dyn TS: init only when both RSL and the Channel OM are established" I99f29d2ba079f6f4b77f0af12d9784588d2f56b3 This keeps osmo-bts operational while fixing ip.access nanobts, where the CHANNEL OM's state prevented the timeslot FSM from entering operation. Change-Id: I4843d03b3237cdcca0ad2041ef6895ff253d8419
2018-07-28large refactoring: use FSMs for lchans; add inter-BSC HONeels Hofmeyr1-3/+8
Add FSMs: - timeslot_fsm: handle dynamic timeslots and OML+RSL availability. - lchan_fsm: handle an individual lchan activation, RTP stream and release, signal the appropriate calling FSMs on success, failure, release. - mgw_endpoint_fsm: handle one entire endpoint with several CI. - assignment_fsm: BSSMAP Assignment Request. - handover_fsm: all of intra, inter-MO and inter-MT handover. Above FSMs absorb large parts of the gscon FSM. The gscon FSM was surpassing the maximum amount events (32), and it is more logical to treat assignment, handover and MGW procedures in separate FSMs. - Add logging macros for each FSM type: - LOG_TS() - LOG_LCHAN() - LOG_MGWEP(), LOG_CI() - LOG_ASSIGNMENT() - LOG_HO() These log with the osmo_fsm_inst where present. New style decision: logging without a final newline char is awkward, especially for gsmtap logging and when other logs interleave LOGPC() calls; we have various cases where the final \n goes missing, and also this invokes the log category checking N times instead of once. So I decided to make these macros *always* append a newline, but only if there is no final newline yet. I hope that the compiler optimizes the strlen() of the constant format strings away. Thus I can log with or without typing "\n" and always get an \n termination anyway. General: - replace osmo_timers, state enums and program-wide osmo_signal_dispatch() with dedicated FSM timeouts, states and events. - introduce a common way to handle Tnnn timers: gsm_timers.h/.c: struct T_def. These can be used (with some macro magic) to define a state's timeout once, and not make mistakes for each osmo_fsm_inst_state_chg(). Details: bsc_subscr_conn_fsm.c: - move most states of this FSM to lchan_fsm, assignment_fsm, handover_fsm and mgw_endpoint_fsm. - There is exactly one state for an ongoing Assignment, with all details handled in conn->assignment.fi. The state relies on the assignment_fsm's timeout. - There is one state for an ongoing Handover; except for an incoming Handover from a remote BSS, the gscon remains in ST_INIT until the new lchan and conn are both established. - move bssmap_add_lcls_status() to osmo_bsc_lcls.c abis_rsl.c: - move all dynamic timeslot logic away into timeslot_fsm. Only keep plain send/receive functions in abis_rsl.c - reduce some rsl functions to merely send a message, rename to "_tx_". - rsl_ipacc_mdcx(): add '_tx_' in the name; move parts that change the lchan state out into the lchan_fsm, the lchan->abis_ip.* are now set there prior to invoking this function. - move all timers and error/release handling away into various FSMs. - tweak ipa_smod_s_for_lchan() and ipa_rtp_pt_for_lchan() to not require an lchan passed, but just mode,type that they require. Rename to ipacc_speech_mode*() and ipacc_payload_type(). - add rsl_forward_layer3_info, used for inter-BSC HO MO, to just send the RR message received during BSSMAP Handover Command. - move various logging to LOG_LCHAN() in order to log with the lchan FSM instance. One drawback is that the lchan FSM is limited to one logging category, i.e. this moves some logging from DRR to DRSL. It might actually make sense to combine those categories. - lose LOGP...LOGPC logging cascades: they are bad for gsmtap logging and for performance. - handle_classmark_chg(): change logging, move cm2 len check out of the cm3 condition (I hope that's correct). - gsm48_send_ho_cmd(): split off gsm48_make_ho_cmd() which doesn't send right away, so that during inter-bsc HO we can make an RR Handover Command to send via the MSC to the remote BSS. assignment_fsm.c: - the Chan Mode Modify in case of re-using the same lchan is not implemented yet, because this was also missing in the previous implementation (OS#3357). osmo_bsc_api.c: - simplify bsc_mr_config() and move to lchan_fsm.c, the only caller; rename to lchan_mr_config(). (bsc_mr_config() used to copy the values to mr_bts_lv twice, once by member assignment and then again with a memcpy.) - During handover, we used to copy the MR config from the old lchan. Since we may handover between FR and HR, rather set the MR Config anew every time, so that FR rates are always available on FR lchans, and never on HR lchans. Depends: I03ee7ce840ecfa0b6a33358e7385528aabd4873f (libosmocore), I1f2918418c38918c5ac70acaa51a47adfca12b5e (libosmocore) Change-Id: I82e3f918295daa83274a4cf803f046979f284366
2018-06-15fix dyn TS init: properly identify BTS on OML OPSTART ACKNeels Hofmeyr1-24/+7
Commit "dyn ts, bts_ipaccess_nanobts.c: init PDCH on Chan OPSTART ACK" bf7099262adf0f27e71a08387747c5cb0d459360 Icf6e25ff068e8a2600562d52726ead65e864ec02 introduced signal S_NM_OPSTART_ACK and passed the FOM header to identify the BTS by. But the FOM header's BTS number is zero on each Abis/IP link, and the BTS and TRX are actually identified by msgb->dst == e1inp_sign_link, member trx. So the initial implementation associated *all* Channel OPSTART ACKs with BTS 0. Pass the entire msgb as S_NM_OPSTART_ACK signal argument, implement a abis_nm_get_ts() to retrieve the proper timeslot and use that during timeslot init. Related: OS#3351 OS#3205 Change-Id: I45ce5c24cb62d00f350df1af1be6c11104d74193
2018-06-07dissolve libbsc: move all to src/osmo-bsc, link .o filesNeels Hofmeyr1-0/+591
Move all of libbsc/ into osmo-bsc/, and separate/move some implementations to allow linking from utils/* and ipaccess/* without pulling in unccessary dependencies. Some utilities use gsm_network and gsm_bts structs, which already include data structures for fairly advanced uses. Move initialization that only osmo-bsc needs into new bsc_network_init() and bsc_bts_alloc_register() functions, so that the leaner tools can use the old gsm_* versions without the need to link everything (e.g. handover and lchan alloc code). In some instances, there need to be stubs if to cut off linking "just before the RSL level" and prevent dependencies from creeping in. - abis_rsl_rcvmsg(): the only program currently interpreting RSL messages is osmo-bsc, the utils are merely concerned with OML, if at all. - paging_flush_bts(): ip.access nanobts models call this when the RSL link is dropped. Only osmo-bsc actually needs to do anything there. - on_gsm_ts_init(): the mechanism to trigger timeslot initialization is related to OML, while this action to take on init would pull in RSL dependencies. utils/ and ipaccess/ each have a stubs.c file to implement these stubs. Tests implement stubs inline where required. From src/utils/, src/ipaccess/ and tests/*/, link in .o files from osmo-bsc/. In order for this to work, the osmo-bsc subdir must be built before the other source trees. (An alternative would be to include the .c files as sources, but that would re-compile them in every source tree. Not a large burden really, but unless linking .o files gives problems, let's have the quicker build.) Minor obvious cleanups creep in with this patch, I will not bother to name them individually now unless code review asks me to. Rationale: 1) libbsc has been separate to use it for osmo-nitb and osmo-bsc in the old openbsc.git. This is no longer required, and spreading over libbsc and osmo-bsc is distracting. 2) Recently, ridiculous linking requirements have made adding new functions cumbersome, because libbsc has started depending on osmo-bsc/*.c implementations: on gscon FSM and bssap functions. For example, neither bs11_config nor ipaccess-config nor bts_test need handover_cfg or BSSMAP message composition. It makes no sense to link the entire osmo-bsc to it, nor do we want to keep adding stubs to each linking realm. Change-Id: I36a586726f5818121abe54d25654819fc451d3bf