pcu: Introduce test TC_nacc_outbound_pkt_cell_chg_notif_nonassigned_dl_tbf

Triggers osmo-pcu assert in nacc_fsm.c due to scheduler not checking if
tbf has TFI assigned before deciding to transmit NACC related messages.

Related: osmo-pcu.git Change-Id I72b2dff28aacdb04909c098c94834ff79f55b31d
Related: SYS#4909
Change-Id: Id293e41e6b4380f2794007779ad430544bbe578a

2 files changed, 103 insertions, 1 deletions

diff --git a/pcu/GPRS_Components.ttcn b/pcu/GPRS_Components.ttcn
index 34406b9f..52667436 100644
--- a/pcu/GPRS_Components.ttcn
+++ b/pcu/GPRS_Components.ttcn
@@ -819,6 +819,22 @@ runs on MS_BTS_IFACE_CT {
 }
 
 
+private function f_ms_gtfi_tmpl(inout GprsMS ms)
+runs on MS_BTS_IFACE_CT return template (present) GlobalTfi {
+	var template (present) GlobalTfi gtfi;
+	if (ispresent(ms.ul_tbf) and ispresent(ms.dl_tbf)) {
+		gtfi := ({ is_dl_tfi := false, tfi := ms.ul_tbf.tfi },
+			 { is_dl_tfi := true, tfi := ms.dl_tbf.tfi });
+	} else if (ispresent(ms.ul_tbf)) {
+		gtfi := { is_dl_tfi := false, tfi := ms.ul_tbf.tfi };
+	} else if (ispresent(ms.dl_tbf)) {
+		gtfi := { is_dl_tfi := true, tfi := ms.dl_tbf.tfi };
+	} else {
+		gtfi := ?;
+	}
+	return gtfi;
+}
+
 altstep as_ms_rx_pkt_neighbor_cell_data(inout GprsMS ms, octetstring exp_si,
 					inout uint5_t exp_container_idx /* := 0 */,
 					inout integer si_offset /* := 0 */,
@@ -827,7 +843,7 @@ altstep as_ms_rx_pkt_neighbor_cell_data(inout GprsMS ms, octetstring exp_si,
 runs on MS_BTS_IFACE_CT {
 	var integer len;
 	var octetstring exp_si_chunk;
-	var GlobalTfi gtfi := { is_dl_tfi := false, tfi := ms.ul_tbf.tfi };
+	var template (present) GlobalTfi gtfi := f_ms_gtfi_tmpl(ms);
 	var BTS_PDTCH_Block data_msg;
 	var boolean do_repeat := true;
 
diff --git a/pcu/PCU_Tests.ttcn b/pcu/PCU_Tests.ttcn
index 4699d3e3..5ab208bb 100644
--- a/pcu/PCU_Tests.ttcn
+++ b/pcu/PCU_Tests.ttcn
@@ -4890,6 +4890,91 @@ testcase TC_nacc_outbound_pkt_cell_chg_notif_twice5() runs on RAW_PCU_Test_CT {
 	}
 }
 
+/* Test MS sending Pkt Cell Change Notification on an MS with an existing but unassigned (no TFI) DL TBF */
+testcase TC_nacc_outbound_pkt_cell_chg_notif_unassigned_dl_tbf() runs on RAW_PCU_Test_CT {
+	var PollFnCtx pollctx;
+	var GprsMS ms;
+	var PCUIF_info_ind info_ind := valueof(ts_PCUIF_INFO_default);
+	var template (value) RlcmacUlCtrlMsg cell_chf_notif;
+	var RlcmacDlBlock dl_block;
+	var uint32_t sched_fn, dl_fn;
+	var CtrlMessage rx_ctrl;
+	var GsmArfcn req_arfcn := 862;
+	var uint6_t req_bsic := 43;
+	var octetstring data := f_rnd_octstring(10);
+
+	/* Initialize osmo-bsc emulation neighbor resolution CTRL port */
+	f_ipa_ctrl_start_server(mp_ctrl_neigh_ip, mp_ctrl_neigh_port);
+
+	/* Initialize NS/BSSGP side */
+	f_init_bssgp();
+	/* Initialize GPRS MS side */
+	f_init_gprs_ms();
+	ms := g_ms[0]; /* We only use first MS in this test */
+
+	/* Initialize the PCU interface abstraction */
+	f_init_raw(testcasename(), info_ind);
+
+	/* Make sure we are not affected by full cache from previous tests */
+	f_pcuvty_flush_neigh_caches();
+
+	/* Establish BSSGP connection to the PCU */
+	f_bssgp_establish();
+	f_bssgp_client_llgmm_assign(TLLI_UNUSED, ms.tlli);
+
+	/* Send PACKET RESOURCE REQUEST */
+	pollctx := f_ms_establish_ul_tbf_2phase_access(ms, ts_RlcMacUlCtrl_PKT_RES_REQ(ms.tlli, ms_racap_gprs_def));
+	/* Pkt Uplink Assignment above sets poll+rrbp requesting PACKET CONTROL ACK */
+	f_ms_tx_ul_block(ms, ts_RLCMAC_CTRL_ACK(ms.tlli), pollctx.fn, nr := pollctx.tstrxbts);
+
+	/* Start NACC from MS side */
+	cell_chf_notif := ts_RlcMacUlCtrl_PKT_CELL_CHG_NOTIF(ms.ul_tbf.tfi, req_arfcn, req_bsic);
+	f_ms_tx_ul_block(ms, ts_RLC_UL_CTRL_ACK(cell_chf_notif), 0, nr := f_ms_tx_TsTrxBtsNum(ms));
+
+	/* osmo-pcu should now ask for resolution: */
+	f_ipa_ctrl_wait_link_up();
+	var charstring ctrl_var := "neighbor_resolve_cgi_ps_from_lac_ci." &
+				    int2str(info_ind.lac) & "." &
+				    int2str(info_ind.cell_id) & "." &
+				    int2str(req_arfcn) & "." &
+				    int2str(req_bsic);
+	f_ctrl_exp_get(IPA_CTRL, ctrl_var, "023-43-423-2-5");
+	/* RIM procedure: */
+	as_outbound_nacc_rim_resolve(info_ind);
+
+	BSSGP[0].send(ts_BSSGP_DL_UD(ms.tlli, data));
+	/* Make sure we leave some time for SGSN->PCU data to arrive to PCU */
+	f_sleep(0.1);
+	/* rx DL assignment, don't ack it yet (keep TBF in state ASSIGN): */
+	f_ms_rx_pkt_ass_pacch(ms, sched_fn, tr_RLCMAC_DL_PACKET_ASS);
+
+	/* NACC: scheduler selects tx Pkt Cell Neighbor Data. Receive first one: */
+	f_ms_handle_pkt_neighbor_cell_data(ms, si_default, single_step := true);
+	/* ACK DL assignment (we do it here on purpose to test tx Pkt Neigh Cell
+	 * Data with unassigned DL TBF in line above): */
+	f_ms_tx_ul_block(ms, ts_RLCMAC_CTRL_ACK(ms.tlli), sched_fn);
+	/* Continue receiving Pkt Cell Neighbor Data */
+	f_ms_handle_pkt_neighbor_cell_data(ms, si_default, f_ms_tx_TsTrxBtsNum(ms), 1, 16);
+
+	/* Obtain a Downlink block and make sure it is a Pkt Cell Chg Continue */
+	f_rx_rlcmac_dl_block(dl_block, sched_fn);
+	if (not match(dl_block, tr_RLCMAC_DL_CTRL(?, tr_RlcMacDlCtrl_PKT_CELL_CHG_CONTINUE))) {
+		setverdict(fail, "Rx unexpected DL block: ", dl_block);
+		f_shutdown(__BFILE__, __LINE__);
+	}
+	/* PKT CELL CHG CONTINUE ACK/NACK sets poll+rrbp requesting PACKET CONTROL ACK */
+	if (dl_block.ctrl.mac_hdr.rrbp_valid) {
+		sched_fn := f_rrbp_ack_fn(sched_fn, dl_block.ctrl.mac_hdr.rrbp);
+		f_ms_tx_ul_block(ms, ts_RLCMAC_CTRL_ACK(ms.tlli), sched_fn);
+	}
+
+	/* Now that we confirmed the new assignment in the dl-tbf, lets receive the data and ack it */
+	f_rx_rlcmac_dl_block_exp_data(dl_block, dl_fn, data, 0);
+	f_acknackdesc_ack_block(ms.dl_tbf.acknack_desc, dl_block, '1'B);
+	f_ms_tx_ul_block(ms, ts_RLCMAC_DL_ACK_NACK(ms.dl_tbf.tfi, ms.dl_tbf.acknack_desc),
+			 f_dl_block_ack_fn(dl_block, dl_fn));
+}
+
 /* Send a RIM RAN info request to the PCU and verify the response, we expect
  * getting the system information back which we have transfered to the PCU via
  * PCUIF on startup. */
@@ -5127,6 +5212,7 @@ control {
 	execute( TC_nacc_outbound_pkt_cell_chg_notif_twice3() );
 	execute( TC_nacc_outbound_pkt_cell_chg_notif_twice4() );
 	execute( TC_nacc_outbound_pkt_cell_chg_notif_twice5() );
+	execute( TC_nacc_outbound_pkt_cell_chg_notif_unassigned_dl_tbf() );
 
 	execute( TC_rim_ran_info_req_single_rep() );
 	execute( TC_rim_ran_info_req_single_rep_no_si() );