| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Fix a brown paper bag bug and call the right method. The above was
an infinite recursion. The stack didn't overflow as the compiler
optimized the tail-recursion and coverity didn't complain either.
The issue was introduced in the last minutes before the merge
when I renamed "reset_handover" to "handover_reset" to follow
the object_verb approach throughout the handover.c code. While
doing that I sadly replaced reset_handover with handover_frame
and not handover_reset.
|
|
|
|
This way we can easily find the place in the code that is responsible
for the NACK.
|
|
Currently ADM state change request that tries to set the
administrative state to the current value are immediately ACK'ed.
Beside the caching problem, this could lead the protocol
inconsistencies if two such requests are sent one after the other and
the second arrives before the procedure of the first has finished.
This patch removes the shortcut in oml_rx_chg_adm_state() which
immediately called oml_mo_statechg_ack(mo).
Ticket: OW#1132
Sponsored-by: On-Waves ehf
|
|
|
|
The dequeue code assumed that msg->l3h is a valid pointer but in
the case of the PCU socket it was a null pointer. This lead to
memcpy copying a lot more than 23 bytes which ultimately lead to
a crash. The issue was introduced in the git commits
37c332e5bfdb9591a1cd3cc6746afffdb1cd13b9 and the commit
d290ee029a827c870f97372b98f0dbd7d057402a.
use msg->l3h = msgb_put(msg, len) to make sure that there is a
valid L3 pointer for the message.
(gdb) bt
#0 0x419d6384 in memcpy () from /tmp/ow/lib/libc.so.6
#1 0x0001894c in bts_ccch_copy_msg (bts=0x62248, out_buf=0x62248 "p\025\003", gt=0x1,
is_ag_res=100684) at bts.c:572
#2 0x0000c958 in handle_ph_readytosend_ind (rts_ind=<optimized out>, fl1=0x62e78)
at l1_if.c:515
#3 l1if_handle_ind (fl1=0x62e78, msg=0x8bb08) at l1_if.c:920
#4 0x000147e8 in read_dispatch_one (queue=<optimized out>, msg=0x8bb08, fl1h=<optimized out>)
at l1_transp_hw.c:190
#5 l1if_fd_cb (ofd=0x62f04, what=<optimized out>) at l1_transp_hw.c:224
#6 0x41b9d028 in osmo_select_main (polling=<optimized out>) at select.c:158
#7 0x0000b204 in main (argc=<optimized out>, argv=<optimized out>) at main.c:384
(gdb) p *msg
$12 = {list = {next = 0x100100, prev = 0x200200}, {dst = 0x0, trx = 0x0}, lchan = 0x0,
l1h = 0x0, l2h = 0x0, l3h = 0x0, l4h = 0x0, cb = {0, 0, 0, 0, 0}, data_len = 23, len = 23,
head = 0x8572c "-\006?\020\r\340*q\224#", tail = 0x85743 "",
data = 0x8572c "-\006?\020\r\340*q\224#", _data = 0x8572c "-\006?\020\r\340*q\224#"}
|
|
In case the max power reduction has been changed through OML,
let us call the l1if_set_txpower routine to update the nominal
power. This has been manually verified with both BTS #1 and #57.
./bsc_control.py -d localhost -p 4249 -s bts.0.trx.0.max-power-reduction 0
The above command and GNUradio have been used to determine if
the power level has changed at all.
Fixes: SYS#268
|
|
These routines do not pass the gsm_abis_mo and parsing the FOM
header of the msg does not seem to be a good idea either. Pass
in the OML object so that the model code can determine what the
void pointer is.
|
|
Older hardware didn't have the external attentuator that was used
to control the wanted output power. So starting from the git commit
3c8ff3c70bc52d0a1d75a1e6b87b0069d92f10f9 older hardware was always
transmitting with 23 dBm regardless of the power reduction.
Remember the hardware revision returned by the SystemInformation
primitive, postpone the call to l1if_activate_rf until we know
the board revision.
Manually verified on BTS #1 and #57. On BTS#1 the external
attenuator has not been configured and on BTS#57 it was.
|
|
|
|
Only restart in case of a crash or the exit(42) when the OML/RSL
link is going down.
|
|
The DSP/FPGA appears to report bogus PhDataInd with hlayer2 == 0.
Currently this would match the TRX==0,TS==0 and SS=0 and then we
report bad measurement reports. Add a magic number to the lower
eight bit of the hLayer2 to differentiate valid numbers.
Addresses:
<0004> measurement.c:97 (bts=0,trx=0,ts=0,ss=0) measurement during state: NONE
<0004> measurement.c:102 (bts=0,trx=0,ts=0,ss=0) no space for uplink measurement
|
|
|
|
|
|
I have extended the principal function that we use for requesting
information to the microcontroller for switching off/on the board
and the PA. And I have extended it for requesting the power status
information of the board and the PA.
Signed-off-by: Alvaro Neira Ayuso <anayuso@sysmocom.de>
|
|
Signed-off-by: Alvaro Neira Ayuso <anayuso@sysmocom.de>
|
|
|
|
We could have a dedicated configure/cflag for the header files
but for now search in the standard directories.
|
|
Include the btsconfig.h for the PACKAGE_VERSION variable.
|
|
Add function for requesting the temperature information to the
microcontroller. I have added a function that we can extend
for requesting more information but in this case we only need to
know the temperature.
I have added to a microcontroller temperature handling function
in the manager for monitoring this information.
Signed-off-by: Alvaro Neira Ayuso <anayuso@sysmocom.de>
|
|
Use of configuration variables has already been implemented here, so
the TODO comment is removed.
Sponsored-by: On-Waves ehf
|
|
Currently a locked cell is actively broadcasting when it is being
bootstrapped after the lock.
This patch adds an initial update of the RF mute state when the TRX
is initialized.
Ticket: OW#1131
Sponsored-by: On-Waves ehf
|
|
When the lchan was activated for handover configure it to wait
for a RACH burst. On release make sure to always release the
RACH SAPI (in case it has been allocated). On the first frame
inform handover.c about it and forward the received access burst
to the handover layer.
Using an E71 it was possible to make a handover for SDCCH and
TCH/F from a nanoBTS but also from itself to itself. The vty
commands of OpenBSC and the silent-call have been used for that.
I didn't verify audio handling so far.
|
|
|
|
|
|
The BTS layer needs to inform the handover code when an access
burst has been received. In turn the handover layer will ask the
bts to modify the channel, it will schedule the physical information
inform the BSC with the HANDOVER DETECTION and waits for the BTS
layer to inform it about the first received frame to stop a timer.
|
|
Introduce the handover.h/handover.c and initialize handover parameters
in OML and remember the activation through RSL.
|
|
|
|
|
|
|
|
This patch implements merging of IMMEDIATE ASSIGN REJECT messages as
suggested in GSM 08.58, 5.7. When a new IMM.ASS.REJ is to be appended
to the AGCH queue and the last message in that queue is of the same
type, the individual entries (up to 4 per message) of both messages
are extracted, combined and stored back. If there are less than 5
entries, all entries fit into the old message and the new one is
discarded. Otherwise, the old message will contain 4 entries and the
remaining ones are stored into the new one which is then appended to
the queue.
Ticket: SYS#224
Sponsored-by: On-Waves ehf
|
|
This patch adds the following VTY commands to tune AGCH queue
handling:
agch-queue-management default
agch-queue-management threshold THRES low LOW high HIGH
Examples:
agch-queue-management default
Resets queue management to default parameters.
agch-queue-management threshold 0 low 25 high 75
Start dropping at 25%, drop all messages above 75% queue length
(relative to max queue length corresponding to T3126). Between
low and high, drop with a probability interpolated linearly
between 0 (low) and 1 (high).
agch-queue-management threshold 50 low 0 high 0
Start dropping at 50% and continue until all IMM.ASS.REJ have
been removed from the front (output) of the queue
Sponsored-by: On-Waves ehf
|
|
Currently, the AGCH queue length is not limited. This can lead to
large delays and network malfunction if there are many IMM.ASS.REJ
messages.
This patch adds two features:
- Don't accept msgs from the RSL layer when the queue is way too
full (safety measure, mainly if bts_ccch_copy_msg() is not being
called by the L1 layer, currently hard coded to 1000 messages)
- Selectively drop IMM.ASS.REJ from the queue output depending on the
queue length
Ticket: SYS#224
Sponsored-by: On-Waves ehf
|
|
This patch extends paging_gen_msg() by adding an output parameter
is_empty that is true, if only a paging message with dummy entries
has been placed into buffer. This feature is then used by
bts_ccch_copy_msg() to insert an AGCH message if is_empty is true.
Ticket: SYS#224
Sponsored-by: On-Waves ehf
|
|
The first test checks the AGCH may queue length computation.
The second test fills the queue by calling bts_agch_enqueue() with a
mix of IMM.ASS and IMM.ASS.REJ. Then it drains the queue by calling
bts_ccch_copy_msg(). After each of both steps, statistics are printed
out.
Sponsored-by: On-Waves ehf
|
|
Counters are added for the following events (use VTY show to query):
- Dropped IMMEDIATE ASSIGN REJECT messages
- Merged IMMEDIATE ASSIGN REJECT messages
- Rejected AGCH messages
- Use of PCH (non-reserved) for AGCH messages
- Use of AGCH (reserved) for AGCH messages
Sponsored-by: On-Waves ehf
|
|
This patch adds a function bts_update_agch_max_queue_length()
to compute a limit of the AGCH queue. This is based on the idea,
that the AGCH queue has a limited drain rate and that CHANNEL
REQUESTs must be answered within a certain time frame, given
by the minimum value of T3126 (see GSM 04.08). When the AGCH queue
reaches that limit, the last message would be delivered in time if
there were no other delays involved (which is not the case).
The calculation is based on the ratio of the number RACH slots and
CCCH blocks per time:
Lmax = (T + 2*S) / R_RACH * R_CCCH
where
T3126_min = (T + 2*S) / R_RACH
R_RACH is the RACH slot rate (e.g. RACHs per multiframe)
R_CCCH is the CCCH block rate (same time base like R_RACH)
The value depends control_channel_desc.ccch_conf and
rach_control.tx_integer (both from SYSINFO_TYPE_3) and should
therefore by called at least each time after one of these is changed.
For this reason, a signal callback is registered under
SS_GLOBAL/S_NEW_SYSINFO which invokes bts_update_agch_max_queue_length().
Sponsored-by: On-Waves ehf
Based-On: "bts: Calculate length of agch queue" by Ivan Kluchnikov
<kluchnikovi@gmail.com>
|
|
Before, this patch the program tried to read the info
of the temperature sensor from a wrong location.
Signed-off-by: Alvaro Neira Ayuso <anayuso@sysmocom.de>
|
|
This could lead to a BSC attempting to release the BCCH or a
PDCH. In the case of the BCCH this lead to a funny crash.
Log:
<0000> rsl.c:605 (bts=0,trx=0,ts=0,ss=4) Sending Connection Failure: cause = 0x01
<0000> rsl.c:1720 (bts=0,trx=0,ts=0,ss=0) Rx RSL DEACTIVATE_SACCH
Backtrace:
Program received signal SIGSEGV, Segmentation fault.
msgb_dequeue (queue=0x4007d2d8) at msgb.c:102
102 llist_del(lh);
(gdb) bt
#0 msgb_dequeue (queue=0x4007d2d8) at msgb.c:102
#1 0x4002ed28 in lapd_dl_flush_tx (dl=0x4007d220) at lapd_core.c:173
#2 0x40030cb4 in lapd_dl_reset (dl=0x4007d220) at lapd_core.c:307
#3 0x40030d00 in lapd_dl_exit (dl=0x4007d220) at lapd_core.c:321
#4 0x40033d80 in lapdm_entity_exit (le=<optimized out>) at lapdm.c:169
#5 0x40033d9c in lapdm_channel_exit (lc=0x4007d214) at lapdm.c:180
#6 0x0001a334 in rsl_tx_rf_rel_ack (lchan=0x4007d180) at rsl.c:505
#7 0x0000e908 in lchan_deactivate_sapis (lchan=0x4007d180) at oml.c:1427
#8 sapi_queue_exeute (lchan=0x4007d180) at oml.c:547
#9 0x0000ead0 in sapi_queue_send (lchan=<optimized out>) at oml.c:571
#10 queue_sapi_command (lchan=<optimized out>, cmd=<optimized out>)
at oml.c:609
#11 queue_sapi_command (lchan=0x4007d180, cmd=<optimized out>) at oml.c:601
#12 0x0000faf0 in enqueue_rel_marker (lchan=0x4007d180) at oml.c:1440
#13 lchan_deactivate (lchan=0x4007d180) at oml.c:1447
#14 0x0001004c in bts_model_rsl_chan_rel (lchan=<optimized out>) at oml.c:1647
#15 0x0001b948 in rsl_rx_rf_chan_rel (lchan=0x4007d180) at rsl.c:844
#16 rsl_rx_dchan (msg=0x75a88, trx=0x4007b038) at rsl.c:1727
#17 down_rsl (trx=0x4007b038, msg=0x75a88) at rsl.c:1853
#18 0x000154d4 in sign_link_cb (msg=<optimized out>) at abis.c:132
#19 0x400701c0 in ?? () from /usr/lib/libosmoabis.so.2
#20 0x400701c0 in ?? () from /usr/lib/libosmoabis.so.2
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
Fixes: OW#1133
|
|
When closing the PCU socket all channels will be closed. In that case
the LAPDm structures might not have been allocated. Mark the channel
as LCHAN_REL_ACT_PCU to avoid going through the RSL code for sending
the message. This avoids a crash when "gprs none" is selected but one
still configures a PDCH and then connects/disconnects the pcu.
#0 llist_del (entry=0x0) at ../include/osmocom/core/linuxlist.h:119
#1 msgb_dequeue (queue=0x400bbc58) at msgb.c:102
#2 0x40110d28 in lapd_dl_flush_tx (dl=0x400bbba0) at lapd_core.c:173
#3 0x40112cb4 in lapd_dl_reset (dl=0x400bbba0) at lapd_core.c:307
#4 0x40112d00 in lapd_dl_exit (dl=0x400bbba0) at lapd_core.c:321
#5 0x40115d80 in lapdm_entity_exit (le=<optimized out>) at lapdm.c:169
#6 0x40115d9c in lapdm_channel_exit (lc=0x400bbb94) at lapdm.c:180
#7 0x0001a334 in rsl_tx_rf_rel_ack (lchan=0x400bbb00) at rsl.c:505
#8 0x0000e908 in lchan_deactivate_sapis (lchan=0x400bbb00) at oml.c:1427
#9 sapi_queue_exeute (lchan=0x400bbb00) at oml.c:547
#10 0x0000ead0 in sapi_queue_send (lchan=<optimized out>) at oml.c:571
#11 queue_sapi_command (lchan=<optimized out>, cmd=<optimized out>) at oml.c:609
#12 queue_sapi_command (lchan=0x400bbb00, cmd=<optimized out>) at oml.c:601
#13 0x0000faf0 in enqueue_rel_marker (lchan=0x400bbb00) at oml.c:1440
#14 lchan_deactivate (lchan=0x400bbb00) at oml.c:1447
#15 0x0001004c in bts_model_rsl_chan_rel (lchan=<optimized out>) at oml.c:1647
#16 0x0001de30 in pcu_sock_close (state=0x62788) at pcu_sock.c:654
#17 0x0001e150 in pcu_sock_read (bfd=0x627a8) at pcu_sock.c:698
#18 pcu_sock_cb (bfd=0x627a8, flags=1) at pcu_sock.c:755
|
|
This reverts commit bbfd21a36cdd10c3b8d83a329042d9ebfb4c5250.
|
|
Currently, the DSP is always configured with u8NbrOfAgch = 1 before
SYSINFO type 3 is received. Thus using a different value for
BS_AG_BLKS_RES may lead to inconsistencies and MS failing to receive
paging messages properly.
This patch adds a warning and error logging and should be reverted
when initialisation is done in proper order.
Sponsored-by: On-Waves ehf
|
|
This patch adds a common function bts_ccch_copy_msg() that provides
and schedules AGCH and PCH messages. It is basically a frontend to
paging_gen_msg() and bts_agch_dequeue() and contains refactored code
from l1_if.c.
Sponsored-by: On-Waves ehf
|
|
This patch adds and updates btsb->agch_queue_length to keep track of
the queue length.
Sponsored-by: On-Waves ehf
|
|
Currently, the msg->data pointer is just set to the IMMEDIATE ASSIGN
message and the len is adjusted accordingly. Unfortunately, this
leaves l2h (pointing to the RSL header) and l3h (pointing to the
FULL_IMM_ASS_INFO IE) in an undefined state (outside of [data, tail]).
The code in bts.c accesses the message via msg->data.
This patch sets l3h and l2h correctly. msgb_l3() will point to the
start of the IMM ASS message and should be used instead of msg->data.
Sponsored-by: On-Waves ehf
|
|
This patch removes the local 'end' and 'exit' implementations (which
aren't used anyway) and uses the generic ones provided by libosmocore
instead, which are enabled automatically when vty_install_default()
is used.
The prompt strings are modified to match those in
libosmocore/openbsc.
Ticket: OW#952
Sponsored-by: On-Waves ehf
|
|
|
|
Use 0x52 as error cause as the nanoBTS is doing the same under the
situation. This has been spotted while testing handover using the
VTY command for handover.
|
|
Use 'var &= ~(1 << x)' to reset bits instead of 'var &= (1 << x)'.
Sponsored-by: On-Waves ehf
|
|
For journald we should not output escape sequences as it is
confusing the output.
|
